Authorization Bypass

opencast-kernel is vulnerable to authorization bypass. The vulnerability exists as a user with the non-standard role, ROLECOURSEADMIN, is able to create new users using the user-utils endpoint...

CVE-2020-5231 Opencast users with ROLE_COURSE_ADMIN can create new users

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

WordPress nd-restaurant-reservations plugin has an unspecified vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. nd-restaurant-reservations is a restaurant reservation management plugin used in it. A security vulnerability exists in WordPress...

July 26, 2019—KB4505903 (OS Build 18362.267)

None None...

Authentication Bypass by Spoofing in express-cart

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

The vulnerability of the account management utility for the Shadow operating system in Astra Linux, which allows a hacker to trigger a service failure

The vulnerability of the account management utility for the Shadow operating system Astra Linux relates to the incorrect assignment of the permission level during user creation. Exploiting this vulnerability allows an attacker with privileged user rights to block access for newly created users...

Security update for exim (important)

This update for exim fixes the following issues: Changes in exim: - specify users with ref:mail, to make them dynamic. boo1046971 - CVE-2017-1000369: Fixed memory leaks that could be exploited to "stack crash" local privilege escalation boo1044692 - Require usermail groupmail to meet new users...

Vtiger CRM does not properly restrict access to application data

Overview Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with th...

Secure Mail Error: "Cannot Safely connect to the server. The server certificate is not trusted."

New Users: When attempting to connect to Secure Mail, new users encounter the following error message: "Cannot safely connect to the server. The server's certificate is not trusted." Already Enrolled Users: Already enrolled users experience the error message: "Access to your company network is no...

User invite functionality available to non-admins

The REST API which manages user invites ensures that only adminstrators can generate a new invite token. However, no similar access controls are present on the methods which are used to invite new users, or to revert to the previous security token – these can be successfully called by any...

Google Fixes 15 Flaws in Chrome

Google has fixed 15 security vulnerabilities in its Chrome browser, including six high-risk bugs. As part of its reward program, Google paid out $6,000 in rewards to researchers who reported flaws. This is one of the larger groups of bug fixes that Google has included in recent releases of Chrome...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication of administrators for requests that create new users via the options action. NOTE: some of these details are obtained from third party information...

CVE-2011-0642

Cross-site request forgery CSRF vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication of administrators for requests that create new users via the options action. NOTE: some of these details are obtained from third party information...

Pixie 1.04 Cross Site Request Forgery

Pixie 1.04 suffers from CSRF where form data can be submitted by the admin unwittingly in this example to add a blog post or Add a new user. It was not tempted but it is possible to include a cookie stealer in the blog post which a naive admin my view if it has a curious/innocent sounding name...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Limny 2.0 allow remote attackers to 1 hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and 2 hijack the authentication of the administrator for...

CVE-2010-0709

Multiple cross-site request forgery CSRF vulnerabilities in Limny 2.0 allow remote attackers to 1 hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and 2 hijack the authentication of the administrator for...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php...

CVE-2008-6947

Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php...

Details Facebook the latest high-risk XSS security vulnerability-vulnerability warning-the black bar safety net

Recently, Facebook discovered high-riskXSSto security vulnerabilities, causing its users to suffer huge threat. This article will for these vulnerabilities are published in detail. Facebook in 2 0 0 8 year 1 2 on 1 5 December 2 0 0 9 years 1 months 4 days was traced to a series of high-riskXSSa...

Gallarific - search.php?query Cross-Site Scripting

Gallarific - search.php?query Cross-Site Scripting source: https://www.securityfocus.com/bid/28163/info Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities. An attacker may leverage these issues to execute arbitrary script code in the...