631 matches found
Samsung Notes 安全漏洞
Samsung Notes is an application from the South Korean company Samsung SAMSUNG. An access control error vulnerability exists in Samsung Notes that stems from improper access control and can be exploited by an attacker to access data in multiple user profiles...
CSRF vulnerability
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not require POST requests for the HTTP endpoint toggling collapsed/expanded status of sidepanel widgets e.g., Build Queue and Build Executor Status widgets, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability...
CVE-2025-26999: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through = 5.9.4.3...
ASB-A-376259166
In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-12038
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyformsnav' shortcode in all versions up to, and including, 2.8.15 due to insufficient input...
CVE-2024-12038: Improper Neutralization of Input During Web Page Generation
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyformsnav' shortcode in all versions up to, and including, 2.8.15 due to insufficient input...
PT-2025-6606 · WordPress · Profilegrid
Name of the Vulnerable Software and Affected Versions: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.9.4.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary...
CVE-2024-13741: Server-Side Request Forgery (SSRF)
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pmuploadimage function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...
CVE-2024-13740: Authorization Bypass Through User-Controlled Key
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for...
Samsung Email Access Control Error Vulnerability
Samsung Email is an email application developed by the Korean company Samsung SAMSUNG, designed to provide users with a convenient interface to manage and process email. Samsung Email suffers from an Access Control Error vulnerability that stems from an improper access control issue included in...
CVE-2025-0589
CVE-2025-0589 affects Octopus Deploy when using Active Directory for authentication. An unauthenticated actor can issue API requests to two endpoints and retrieve data from the associated AD: one endpoint returns user profile details (Email address/UPN and Display name); the other returns group i...
CERTFR-2025-ACT-006
creationtimestamp| type| source ---|---|--- 2025-02-10 14:15:14+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/113980008875615207 2025-02-10 14:15:15+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lhtdf663cm2z 2025-02-11 09:00:04+00:00| seen|...
CVE-2025-20884
Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles...
CVE-2025-20898
Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles...
CVE-2025-20894
Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles...
CVE-2024-12602
creationtimestamp| type| source ---|---|--- 2025-02-06 13:16:49+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhj6aypkuy2n 2025-02-06 16:04:04+00:00| seen| https://t.me/cvedetector/17394 2025-02-06 16:43:55+00:00| seen|...
Cross-site Scripting (XSS)
Overview ckan is a world’s leading Open Source data portal platform. It powers dozens of Open Data portals around the world, including data.gov, open.canada.ca and europeandataportal.eu but also regional, research and community organizations. It makes easy to publish, share and find data online a...
CVE-2024-1169
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyformsuploadhandledroppedmedia function in all versions up to, and...