37148 matches found
CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
EUVD-2026-67123
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817
Flowintel versions ≥3.3.0 are affected by an insecure direct object reference (broken object-level authorization) across numerous task endpoints. The routes accepted both a case ID and a task ID but did not verify that the task belonged to the supplied case, allowing an authenticated user with ed...
WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Md Mehedi Hasan in WordPress Plugin WP Job Portal versions = 2.5.9...
ADSyncDump-BOF
ADSyncDump BOF Das ADSyncDump-BOF ist ein Port von Dirkjan Mollemas adconnectdump.py / ADSyncDecrypt in eine Beacon Object File BOF für die Verwendung mit Cobalt Strike, Sliver und Havoc. !NOTE Das Tool wurde auf einem Windows Server 2019 mit Azure AD Connect Version 2.2.1.0 getestet. Die...
f_hid-4.14-backports
Backports de fhid para Linux 4.14.190 SM-A525F Três correções para drivers/usb/gadget/function/fhid.c, aplicadas manualmente a um kernel Android de fornecedor 4.14.190 e verificadas no dispositivo em que rodam. 4.14 está em fim de vida. Não existe backport estável para nenhuma destas correções, e...
CVE-2020-6364
CVE-2020-6364 Execução remota de código no CA APM Team Center Wily Introscope. Aviso original Uma vulnerabilidade de desserialização no CA APM Team Center leva à execução remota de código não autenticada no servidor. Ao autenticar no servidor, um cookie é retornado começando com a infame string...
CVE-2026-81658
Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...
EUVD-2026-66996
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-78286
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
cve-2026-39440-funnelforms-fix
Fix per CVE-2026-39440 FunnelForms Un plugin WordPress drop-in che blocca il gestore Demo Import vulnerabile in FunnelForms Pro ≤ 3.8.1 per mitigare l'esecuzione remota di codice CVE-2026-39440, CVSS 9.9. La vulnerabilità...
CVE-2020-28351
ShoreTel 19.46.1802.0 Attacco Cross Site Scripting Riflesso Il componente per conferenze sui dispositivi Mitel ShoreTel 19.46.1802.0 potrebbe consentire a un utente malintenzionato non autenticato di condurre un attacco di cross-site scripting riflesso XSS tramite PATHINFO verso index.php, a caus...
CVE-2026-4800-POC
CVE-2026-4800-POC Advisory di Sicurezza https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC root@kitploit: const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; Flusso...
CVE-2026-35678
Rapporto di Ricerca sulle Vulnerabilità: Insecure Direct Object Reference IDOR Universale in Eduplus Student ERP Ricercatore: Vinay Sharma 1. Sintesi Esecutiva Questo rapporto descrive una vulnerabilità di sicurezza ad alta gravità identificata nella piattaforma Eduplus Student ERP, in particolar...