Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

None...

PT-2022-6498 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions 3.5.x through 3.5.2 Description: The issue is related to the undo mark statuses as sensitive method in app/services/approve appeal service.rb, which does not use the server's representative account. This results in moderator...

Nextcloud: Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

Summary: add summary of the vulnerability Steps To Reproduce: 1. Create a Call as User A Moderator 2. Add User B to the call 3. Start the call as User A 4. User B joins the call and enables the camera 5. User A removes all permissions for User B, cam and mic are now disabled 6. User A grants all...

GHSA-XQ58-69H2-765M Cross Site Request Forgery in mailman

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...

CVE-2021-44227

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...

Security fix for the ALT Linux 9 package mailman version 5:2.1.36-alt1

Nov. 13, 2021 Konstantin Lepikhov 5:2.1.36-alt1 - Updated to 2.1.36. - Security fixes: + CVE-2021-43331: A potential XSS attack via the user options. + CVE-2021-43332: A potential for for a list moderator to carry out an off-line brute force attack to obtain the list admin password...

mailman -- 2.1.37 fixes XSS via user options, and moderator offline brute-force vuln against list admin password

Mark Sapiro reports: A potential XSS attack via the user options page has been reported by Harsh Jaiswal. This is fixed. CVE-2021-43331 LP: 1949401. A potential for for a list moderator to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

Code injection

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

AM Live Vulnerability Management Conference Part 1: Full video in Russian + Timecodes in English

Hello all! 2 weeks ago I participated in the best online event fully dedicated to Vulnerability Management in Russia. It was super fun and exciting. Thanks to all the colleagues and especially to Lev Paley for the great moderation! I have talked out completely. Everything I wanted and the way I...

CVE-2021-27949

Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...

CVE-2021-27949

Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...

Cross site scripting

Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...

CVE-2021-27949

Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...

CVE-2021-27949

CVE-2021-27949: MyBB prior to 1.8.26 is vulnerable to Cross-site Scripting via the Custom moderator tools. The issue affects the MyBB web forum software (PHP/MySQL) and is triggered through inputs handled by moderator tools, enabling injected scripts to run in a victim’s browser. The recommended ...

PT-2021-17689 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.26 Description: The issue is related to a Cross-site Scripting vulnerability. It affects the Custom moderator tools in MyBB. Recommendations: For versions prior to 1.8.26, update to version 1.8.26 or later to resolv...

MyBB 跨站脚本漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MyBB MYBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB before 1.8.26, which stems from a cross-site...

Invision Power Services, Inc.: PHP Code Injection through "previewBlock()" method

Summary: The vulnerability exists because the IPS\cms\modules\front\pages\builder::previewBlock method allows to pass arbitrary content to the IPS\Theme::runProcessFunction method, which will be used in a call to the eval function. This can be exploited to inject and execute arbitrary PHP code...

Logitech: Moderator user has access to owner's support portal and tickets

Summary: Hi there, In https://streamlabs.com, there's a function where users can share his account to other users to manage their dashboard via following link. https://streamlabs.com/dashboard/settings/shared-access. In shared-access setting, user can invite other user with two roles Moderator an...