16 matches found
CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...
CVE-2026-44561 Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the isuserchannelmember function checks whether a ChannelMember row exists but does not check the isactive field. When a user is deactivated from a group or DM channel removed by the...
EUVD-2019-11399
Malware in sbrugna...
EUVD-2018-13770
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2022-2512
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all version...
Linux Distros Unpatched Vulnerability : CVE-2022-0373
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk emai...
CVE-2020-26412
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2...
CVE-2019-15731
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so...
GO-2024-2764 Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them in github.com/rancher/rancher
Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them in github.com/rancher/rancher...
PT-2024-18266 · Lunary Ai · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.0.1 Description: The issue allows removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform...
CVE-2021-28167
In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a us...
CVE-2019-20862
Mattermost Server before 5.13.0 is affected by CVE-2019-20862: non-members may fetch a team's slash commands. The connected sources confirm the affected product and impact description but do not provide root-cause details or a formal remediation/patch version. No exploitation specifics are includ...
CVE-2020-14457
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...
PT-2020-11905 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 8.3 through 12.8.1 Description: The issue allows certain non-members to access the Contribution Analytics page of a private group, resulting in information disclosure. Recommendations: For GitLab versions 8.3 through 12.8.1,...
CVE-2020-9386
In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...