CVE-2023-24384

Cross-Site Request Forgery CSRF vulnerability in WpDevArt Organization chart = 1.4.4 versions...

CVE-2023-3426

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

CVE-2023-22738

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain...

CVE-2023-1065

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploi...

CVE-2023-27113

pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php...

CVE-2023-6218

In Progress MOVEit Transfer versions released before 2022.0.9 14.0.9, 2022.1.10 14.1.10, 2023.0.7 15.0.7, a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an...

CVE-2022-42903

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

Grafana OSS 安全漏洞

Grafana OSS is a visual dashboard in Grafana open source. A security vulnerability exists in Grafana OSS that stems from an access control issue in the DELETE /api/org/users/ endpoint that could cause an organization administrator to permanently delete the server administrator account...

CVE-2021-30479

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...

CVE-2021-0982

In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-30487

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation...

CVE-2017-1000106

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...

CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

Organization admin can delete server admin in Grafana

An access control vulnerability was discovered in Grafana where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: An Organization administrator exists...

CVE-2024-2643

CVE-2024-2643 affects the WordPress plugin My Sticky Bar prior to version 2.6.8. The issue is a failure to sanitize/escape certain settings, enabling stored cross-site scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, such as in multisite setup...

CVE-2024-1663

CVE-2024-1663 affects the WordPress plugin Ultimate Noindex Nofollow Tool II (versions before 1.3.6). The issue is a lack of sanitization/escaping of certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Impact is a...

CVE-2024-0970

CVE-2024-0970 concerns the WordPress plugin User Activity Tracking and Log (pre-4.1.4). The vulnerability stems from retrieving client IP addresses from untrusted headers, enabling an attacker to spoof/manipulate the logged IP address in activity logs. Public sources in the connected data confirm...

CVE-2024-0852

coreActivity: Activity Logging plugin for WordPress (prior to 1.8.1) is vulnerable to unauthenticated Stored XSS due to insufficient escaping of certain request data when rendering in the admin logs dashboard. The issue allows an unauthenticated attacker to craft input that could execute JavaScri...

CVE-2024-0249

CVE-2024-0249 affects the WordPress plugin Advanced Schedule Posts (versions ≤ 2.1.8). The vulnerability is a Reflected Cross‑Site Scripting (XSS) caused by not sanitising/escaping a parameter before echoing it on the page, which could impact high‑privilege users (e.g., admins). Exploitation stat...

CVE-2023-7239

CVE-2023-7239 affects the WordPress WP Dashboard Notes plugin prior to 1.0.11. The vulnerability arises because the wpdn_update_note AJAX action does not validate that the requesting user has access to the specified post_id, enabling users with a Contributor role or higher to update notes created...