87648 matches found
CVE-2026-79669
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
CVE-2026-79666
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...
CVE-2026-79661
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...
CVE-2026-77997
Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...
CVE-2023-2868CVE-2023-2868
Questo repository non contiene un README...
CVE-2023-30185
Questo repository non contiene un README...
CVE-2020-36079.
Questo repository non contiene un README...
EUVD-2026-65472
Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...
CVE-2026-77997
YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.41 contain a missing access check that allows authenticated users holding com_template editing permissions to view information about arbitrary site modules without the corresponding com_modules permissions. This constitu...
CVE-2026-77997 Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...
CVE-2026-77997 Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...
BIT-KEYCLOAK-2026-9099 Keycloak: group-admin escalation to realm-admin
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 FGAPv2 is enabled, an attacker wi...
BIT-KEYCLOAK-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...
CVE-2026-79669
Ech0 versions before 4.4.3 lack authorization checks on system log endpoints, allowing any authenticated non-admin user to read and stream all server logs. The vulnerable endpoints are GET /api/system/logs , GET /api/system/logs/stream , and WS /ws/system/logs . An attacker can gather reconnaissa...
EUVD-2026-65445
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
CVE-2026-79666
Ech0 versions before 4.4.3 fail to enforce administrator authorization on dashboard log endpoints. Any authenticated user can query GET /api/system/logs and subscribe to SSE and WebSocket log streams, retrieving sensitive operational data including file paths, stack traces, and internal URLs . Th...
CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...
EUVD-2026-65448
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...