CVE-2025-27134

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint "PATCH /api/users/:id"...

CVE-2025-27134: Improper Access Control

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id t...

PT-2023-26792 · Bmc · Bmc Control-M

Name of the Vulnerable Software and Affected Versions: BMC Control-M versions prior to 9.0.21 BMC Control-M version 9.0.20.200 Description: The issue allows SQL injection via the "/RF-Server/report/deleteReport" API endpoint, specifically through the report-id parameter. Recommendations: For BMC...

CVE-2023-22487

Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special "@""p" syntax. The following behavior never changes no matter if the actor should be able to read the mentioned po...

Design/Logic Flaw

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user a...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-41170)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.1. An attacker non-channel member can exploit the vulnerability to modify the channel using the Channel PATCH API...

CVE-2018-21255

An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...

CVE-2018-21255

An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...

CVE-2018-21255

The CVE-2018-21255 issue affects Mattermost Server prior to 5.1, where non-members of a channel could use the Channel PATCH API to modify that channel. The connected documents corroborate this vulnerability across multiple sources (Red Hat, CNVD, OSV, NVD, CVE lists) without providing concrete ex...

CVE-2018-21255

An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...

CVE-2018-21255: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...

PT-2020-8898

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered where non-members of a channel could use the "Channel PATCH API" to modify that channel. Recommendations For versions prior to 5.1, update to version 5.1 or later to...