CVE-2026-34751

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

EUVD-2020-18659

Malware in sbrugna...

CVE-2025-7734: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...

CVE-2025-6948

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...

CVE-2020-26029

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header...

CVE-2024-6674: Origin Validation Error

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...

PT-2023-31374

Name of the Vulnerable Software and Affected Versions LiveChat – WP live chat plugin for WordPress versions through 4.5.15 Description A Cross-Site Request Forgery CSRF issue affects the LiveChat – WP live chat plugin for WordPress. This issue allows an attacker to perform actions on behalf of a...

PT-2023-9342

Name of the Vulnerable Software and Affected Versions Tinode Chat affected versions not specified Description The issue is related to a cross-site request forgery CSRF attack. It can be exploited by a remote attacker using a specially crafted web page, allowing them to perform actions on behalf o...

How to investigate service provider trust chains in the cloud

In a recent Microsoft blog post, we documented technical guidance for organizations to protect themselves from the latest NOBELIUM activity that was found to target technology service providers, which are privileged in their downstream customer tenants, as a method to gain access to their...

CVE-2020-26029

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header...

CVE-2020-26029

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header...

CVE-2020-26029: Incorrect Authorization

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header...

PT-2020-16266

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1 Description An issue was discovered in the authorization checks for impersonation requests via the X-On-Behalf-Of header. The authorization checks are performed for the actual user and not the one given in the...

PT-2020-19624

Name of the Vulnerable Software and Affected Versions EcoStruxure and SmartStruxure Power Monitoring and SCADA Software affected versions not specified Description A CWE-79: Improper Neutralization of Input During Web Page Generation issue exists that could allow an attacker to perform actions on...

PT-2020-8324

Name of the Vulnerable Software and Affected Versions: NETGEAR R6100 versions prior to 1.0.1.12 NETGEAR R7500 versions prior to 1.0.0.108 NETGEAR WNDR3700v4 versions prior to 1.0.2.86 NETGEAR WNDR4300v1 versions prior to 1.0.2.88 NETGEAR WNDR4300v2 versions prior to 1.0.0.48 NETGEAR WNDR4500v3...

CVE-2019-1258

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this...

CVE-2019-1258

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this...

Azure Active Directory Authentication Library Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this...

Microsoft Azure Active Directory Authentication Library Elevation of Privilege Vulnerability

Microsoft Azure Active Directory Authentication Library is an authentication library from Microsoft Corporation USA. This product allows client applications to authenticate users. An elevation of privilege vulnerability exists in On-Behalf-Of flow in the Azure Active Directory Authentication...

CVE-2019-1258: Undefined Security Weakness

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this...