CVE-2022-23802

Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information remote. The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components,...

Information disclosure

Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information remote. The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components,...

CVE-2022-27909

In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files...

HumHub 安全漏洞

Humhub is a set of open source social networking software written on the Yii PHP framework. HumHub has a security vulnerability that stems from the fact that users who are forced by administrators to change their passwords may be able to retrieve data from other users. No detailed vulnerability...

CVE-2022-22328

IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871...

JFrog Artifactory 安全漏洞

JFrog Artifactory is an open source general-purpose Artifact repository manager from Israel-based JFrog Jfrog that supports clustering and high-availability Docker registries and provides an end-to-end automation solution for tracking artifacts from development to production.JFrog Artifactory...

USN-5279-1 util-linux vulnerabilities

It was discovered that util-linux incorrectly handled unmounting FUSE filesystems. A local attacker could possibly use this issue to unmount FUSE filesystems belonging to other users...

Minetest 安全漏洞

Minetest is a free open source voxel game engine by The Minetest Team team. It is used for module and game creation. A security vulnerability exists in minetest that stems from the ability to add or remove items from different users' inventories...

Sourcecodester Hospital Patient Records Management System 安全漏洞

SourceCodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. sourceCodester Hospital Patient Records Management System version 1.0 contains a horizontal override vulnerability, whi...

Red Hat Keycloak 访问控制错误漏洞

A security vulnerability exists in Red Hat Keycloak, a suite of software from Red Hat that provides authentication and management capabilities for modern applications and services. keycloak has a security flaw that stems from incorrect authorization of Keycloak allowing unprivileged users to crea...

HTCondor 安全漏洞

HTCondor is a workload management system. HTCondor has a security vulnerability that could be exploited by an attacker to take control of other users' jobs or read secrets from their data...

WordPress 插件安全漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Page/Post Content Shortcode plugin in and prior versions is vulnerable to an authorization...

Digi International Digi TransPort 安全漏洞

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi International Digi TransPort, which can be exploited by an authenticated attacker to read a password file passwords are reversible from the device, whi...

CVE-2021-24842

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1 list private post titles of other users and 2 change the posted date of other users' posts...

UBUNTU-CVE-2021-43560

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

Fortinet FortiManager 信息泄露漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...

CVE-2021-33679

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

CVE-2021-24501

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site...