CVE-2024-9612 Unauthorized Access in danswer-ai/danswer

In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end doe...

CVE-2023-32063 OroCRMCallBundle has incorrect call view page visibility

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1...

WebKit - enqueuePageshowEvent enqueuePopstateEvent Universal Cross-Site Scripting

WebKit - enqueuePageshowEvent enqueuePopstateEvent Universal Cross-Site Scripting view-frame.page; frame.tree.appendChildchildFrame-view-frame; childFrame-open; enqueuePageshowEventPageshowEventPersisted; HistoryItem historyItem = frame.loader.history.currentItem; if historyItem &&...