6036 matches found
CVE-2023-6218
In Progress MOVEit Transfer versions released before 2022.0.9 14.0.9, 2022.1.10 14.1.10, 2023.0.7 15.0.7, a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an...
CVE-2022-42903
Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...
Grafana OSS 安全漏洞
Grafana OSS is a visual dashboard in Grafana open source. A security vulnerability exists in Grafana OSS that stems from an access control issue in the DELETE /api/org/users/ endpoint that could cause an organization administrator to permanently delete the server administrator account...
CVE-2021-30479
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...
CVE-2021-0982
In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
CVE-2021-30487
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation...
CVE-2017-1000106
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...
CVE-2017-1000110
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...
Organization admin can delete server admin in Grafana
An access control vulnerability was discovered in Grafana where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: An Organization administrator exists...
CVE-2024-2643
CVE-2024-2643 affects the WordPress plugin My Sticky Bar prior to version 2.6.8. The issue is a failure to sanitize/escape certain settings, enabling stored cross-site scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, such as in multisite setup...
CVE-2024-1663
CVE-2024-1663 affects the WordPress plugin Ultimate Noindex Nofollow Tool II (versions before 1.3.6). The issue is a lack of sanitization/escaping of certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Impact is a...
CVE-2024-0970
CVE-2024-0970 concerns the WordPress plugin User Activity Tracking and Log (pre-4.1.4). The vulnerability stems from retrieving client IP addresses from untrusted headers, enabling an attacker to spoof/manipulate the logged IP address in activity logs. Public sources in the connected data confirm...
CVE-2024-0852
coreActivity: Activity Logging plugin for WordPress (prior to 1.8.1) is vulnerable to unauthenticated Stored XSS due to insufficient escaping of certain request data when rendering in the admin logs dashboard. The issue allows an unauthenticated attacker to craft input that could execute JavaScri...
CVE-2024-0249
CVE-2024-0249 affects the WordPress plugin Advanced Schedule Posts (versions ≤ 2.1.8). The vulnerability is a Reflected Cross‑Site Scripting (XSS) caused by not sanitising/escaping a parameter before echoing it on the page, which could impact high‑privilege users (e.g., admins). Exploitation stat...
CVE-2023-7239
CVE-2023-7239 affects the WordPress WP Dashboard Notes plugin prior to 1.0.11. The vulnerability arises because the wpdn_update_note AJAX action does not validate that the requesting user has access to the specified post_id, enabling users with a Contributor role or higher to update notes created...
CVE-2023-7230
CVE-2023-7230 affects the WordPress plugin illi Link Party! (versions
CVE-2023-7231
The CVE-2023-7231 entry covers the illi Link Party! WordPress plugin (
CVE-2023-7196
CVE-2023-7196 affects the WordPress plugin Ultimate Noindex Nofollow Tool (versions
CVE-2023-7174
CVE-2023-7174 affects the WordPress plugin aBitGone CommentSafe (versions ≤ 1.0.0). The vulnerability arises from missing CSRF checks, lack of sanitisation and escaping, enabling a logged‑in admin to store XSS payloads via CSRF. Public documentation indicates the issue is present in 1.0.0 and ear...