108 matches found
CVE-2025-10149
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...
CVE-2025-10149
Multiple WSO2 products are vulnerable to arbitrary operations via SCIM 1.1 or 2.0 endpoints due to insufficient authorization validation for federated users. When a federated user and a local user share the same username, the federated user can perform actions intended for the local account, pote...
EUVD-2025-211118
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...
CVE-2025-10149 Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...
CVE-2026-53547: Missing Authorization
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...
PT-2026-35310
Summary MarkdownBody, the shared component used to render every Markdown surface in the Paperclip UI issue documents, issue comments, chat threads, approvals, agent details, export previews, etc., passes urlTransform=url = url to react-markdown. That override replaces react-markdown's built-in...
EUVD-2021-12807
Malware in sbrugna...
EUVD-2018-2011
Malware in sbrugna...
EUVD-2020-7920
Malware in sbrugna...
EUVD-2019-3013
Malware in sbrugna...
EUVD-2018-11788
Malware in sbrugna...
EUVD-2021-2414
Malware in sbrugna...
EUVD-2023-40112
Malicious code in bioql PyPI...
EUVD-2025-14949
Malicious code in bioql PyPI...
EUVD-2024-2144
Malicious code in bioql PyPI...
EUVD-2022-2228
Malicious code in bioql PyPI...
EUVD-2023-50665
Malicious code in bioql PyPI...
EUVD-2024-0825
Malicious code in bioql PyPI...
CVE-2024-12827
CVE-2024-12827 affects the DWT - Directory & Listing WordPress Theme up to version 3.3.6. The root cause is an insufficient check for an empty token value in dwt_listing_reset_password(), enabling unauthenticated attackers to reset arbitrary user passwords (including admins) and take over account...
CVE-2025-22144
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when t...