15 matches found
EUVD-2024-55648
The silent Just-In-Time JIT provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users wi...
EUVD-2018-0086
Malware in sbrugna...
EUVD-2001-0128
Malware in sbrugna...
Kotti CSRF in the local roles implementation
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
GHSA-3HQ4-F2V6-Q338 Kotti CSRF in the local roles implementation
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
Cross-site Request Forgery (CSRF)
kotti is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists when assigning local roles where a change in permission can occur in the /admin-document/@@share view request...
CVE-2018-9856
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
Cross site request forgery (csrf)
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
PYSEC-2018-10
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
PYSEC-2018-10
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
CVE-2018-9856
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
CVE-2018-9856
Kotti vulnerability CVE-2018-9856 affects Kotti before 1.3.2 and 2.x before 2.0.0b2. The issue is CSRF in the local roles implementation, demonstrated by triggering a permission change via the /admin-document/@@share request. The connected sources explicitly identify the vulnerable component as t...
CVE-2001-0128
Zope before 2.2.4 contains a bug in how local roles are computed, enabling bypass of access restrictions and privilege escalation. The issue is documented across multiple sources (NVD/CVE entry and Mandrake MDKSA-2000:086) and affects Zope 2.2.4 and earlier. Remediation is to apply the update to ...
