CVE-2024-29215

Mattermost Server vulnerability CVE-2024-29215: Improper access control in slash commands linked to playbook tasks allows a user to run a slash command in a channel they are not a member of. Affected versions: Mattermost 9.5.x up to 9.5.3; 9.7.x up to 9.7.1; 9.6.x up to 9.6.1; 8.1.x up to 8.1.12....

CVE-2024-36255

Mattermost CVE-2024-36255 involves improper input validation on post actions in affected releases, enabling an attacker to execute a playbook checklist task command as another user by crafting a deceptive post action that unexpectedly runs a slash command in an arbitrary channel. Affected version...

CVE-2024-36255 Post actions can run playbook checklist task commands

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in...

CVE-2024-36255 Post actions can run playbook checklist task commands

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in...

CVE-2024-36255 Post actions can run playbook checklist task commands

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in...

Mattermost Server 安全漏洞

Mattermost Server is an open source messaging platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost Server that stems from an inability to perform proper input validation for late operations, allowing an attacker to execute slash commands as another...

PT-2024-26935 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue arises from inadequate input validation on post actions, allowing an attacker to execute a playboo...

CVE-2024-32958

Cross-Site Request Forgery CSRF vulnerability in Giorgos Sarigiannidis Slash Admin allows Cross-Site Scripting XSS.This issue affects Slash Admin: from n/a through 3.8.1...

CVE-2024-32958

CVE-2024-32958 is a CSRF vulnerability in the WordPress plugin Slash Admin that allows Cross‑Site Scripting (XSS). Affected versions are Slash Admin

PT-2024-25005 · Unknown · Giorgos Sarigiannidis Slash Admin

Name of the Vulnerable Software and Affected Versions: Giorgos Sarigiannidis Slash Admin versions 3.8.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS in Giorgos Sarigiannidis Slash Admin. Recommendations: For Giorgos...

WordPress plugin Slash Admin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. WordPress plugin Slash Admin...

WordPress Slash Admin plugin <= 3.8.1 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Slash Admin versions = 3.8.1...

WordPress Slash Admin Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Slash Admin Type Plugin Vulnerable versions = 3.8.1 Fixed in 3.8.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-32958 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 52a29e92a4ae Credits Cronus Required...

BIT-GITLAB-2021-39938

A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted...

BIT-GITLAB-2023-5356 Incorrect Authorization in GitLab

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user...

CVE-2024-25609

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to...

Serenity Security Breach

Serenity is Serenity Software open source an ASP.NET Core/TypeScript application platform . Designed to simplify and shorten the development of data-centric business applications through a service-based architecture . Serenity 6.8.0 prior to the version of a security vulnerability , the...

CLSA-2024-1706700142 php: Fix of 8 CVEs

CVE-2021-21702: Fix null pointer crash because of malformed SOAP server response - CVE-2021-21703: Fix error in php fpm shared memory organization leading to privilage escalation - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE - CVE-2022-31626: Fix buffer overflow in mysqlnd...

UBUNTU-CVE-2023-5356

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user...

CVE-2023-5356 Incorrect Authorization in GitLab

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user...