CVE-2026-8239

CVE-2026-8239 CVE-2026-8239는 Concrete CMS 9.5.0 및 이전 버전에 영향을 미치는 안전하지 않은 직접 객체 참조IDOR 취약점입니다. 이 취약점은 /ccm/frontend/conversations/getrating 엔드포인트에 존재하며, 공격자가 임의의 메시지 ID를 제공하여 대화 메시지의 존재 여부를 확인하고 평점 점수를 검색할 수 있게 합니다. 해당 엔드포인트는 요청된 정보를 반환하기 전에 적절한 권한 검사를 수행하지 않습니다. 영향받는 소프트웨어 제품: Concrete CMS 영향받는 버...

CVE-2026-8238: Missing Authorization

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/messagepage' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and th...

CVE-2025-12738: Exposure of Sensitive Information to an Unauthorized Actor

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

EUVD-2020-23535

Malware in sbrugna...

Rocket.Chat: Message ID Enumeration with Action Link Handler

Summary The actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries. Releases Affected: The Meteor method actionLinkHandler calls an actionLinks wrapper getMessage to find affected messages: javascript Meteor.methods actionLinkHandlername, messageId if...