EUVD-2024-55648

The silent Just-In-Time JIT provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users wi...

EUVD-2018-0086

Malware in sbrugna...

EUVD-2001-0128

Malware in sbrugna...

Kotti CSRF in the local roles implementation

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

GHSA-3HQ4-F2V6-Q338 Kotti CSRF in the local roles implementation

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

Cross-site Request Forgery (CSRF)

kotti is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists when assigning local roles where a change in permission can occur in the /admin-document/@@share view request...

CVE-2018-9856

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

PYSEC-2018-10

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

PYSEC-2018-10

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

Cross site request forgery (csrf)

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

CVE-2018-9856

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

CVE-2018-9856

Kotti vulnerability CVE-2018-9856 affects Kotti before 1.3.2 and 2.x before 2.0.0b2. The issue is CSRF in the local roles implementation, demonstrated by triggering a permission change via the /admin-document/@@share request. The connected sources explicitly identify the vulnerable component as t...

CVE-2018-9856: Cross-Site Request Forgery (CSRF)

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

CVE-2001-0128

Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges...

CVE-2001-0128

Zope before 2.2.4 contains a bug in how local roles are computed, enabling bypass of access restrictions and privilege escalation. The issue is documented across multiple sources (NVD/CVE entry and Mandrake MDKSA-2000:086) and affects Zope 2.2.4 and earlier. Remediation is to apply the update to ...

CVE-2001-0128: Undefined Security Weakness

Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges...

CVE-2001-0128

Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges...