CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...

GHSA-774G-R3FM-4V85 CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...

Improper Privilege Management in craftercms

A logged-in and authenticated user with a Reviewer Role may lock a content item...

GHSA-FJ9V-G8FW-VXMF Improper Privilege Management in craftercms

A logged-in and authenticated user with a Reviewer Role may lock a content item...

CVE-2021-23265

A logged-in and authenticated user with a Reviewer Role may lock a content item...

CVE-2021-23265

A logged-in and authenticated user with a Reviewer Role may lock a content item...

Information disclosure

A logged-in and authenticated user with a Reviewer Role may lock a content item...

CVE-2021-23265 Improper Privilege Management in Crafter Studio

A logged-in and authenticated user with a Reviewer Role may lock a content item...

CVE-2021-23265

Technical details about CVE-2021-23265 are not publicly provided in the supplied documents. The materials confirm a privilege-related issue in Crafter CMS allowing a Reviewer to lock content, but no specifics on affected versions or fix are included. Monitor for updates.

CVE-2021-23265

A logged-in and authenticated user with a Reviewer Role may lock a content item...

PT-2022-9386 · Crafter +3 · Crafter Cms +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A logged-in and authenticated user with a Reviewer Role may lock a content item. There is no information provided about the estimated number of...

Apache Syncope JEXL Code Injection

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

GHSA-R2XF-W5PJ-9PW8 Apache Syncope JEXL Code Injection

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

CVE-2022-29433

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

OpenStack Identity Keystone Improper Privilege Management

OpenStack Identity Keystone before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID...

GHSA-Q9QR-H33G-FW3J TeamPass Storing Passwords in a Recoverable Format vulnerability

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role...

Moodle Users could elevate their role when accessing the LTI tool on a provider site

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...

GHSA-5WG9-5W3F-HXMH Moodle Users could elevate their role when accessing the LTI tool on a provider site

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...

GHSA-8VJJ-WF73-W882 Moodle Incorrect Default Settings

The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role...

Moodle does not properly restrict comment capabilities

comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...