Integer Overflow Vulnerability in _addSplittable Function.

Lines of code Vulnerability details Impact splitsStorage.splitsStatesuserId.balancesassetId.splittable += amt; This vulnerability, if exploited, would allow an attacker to add a large amount of funds to a user's splittable balance, causing it to exceed the maximum value that the uint128 type can...

The vulnerability of the ALSA:pcm component (the audio subsystem of the Linux operating system), which allows a hacker to cause a service failure and gain unauthorized access to protected information.

The vulnerability of the ALSA:pcm component the audio subsystem of the Linux operating system is related to a synchronization violation in sndctlelemreaduser. Exploiting this vulnerability can allow an attacker to cause service failures and gain unauthorized access to protected information...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform xwiki-platform-oldcore version 11.7RC1 and later versions, which stems from a missing authorization in UsersetDisabledStatus...

CVE-2022-41929 Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in UsersetDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched ...

SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download

The plugin does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server PoC Open the following URL when being logged in as any user...

Rocky Linux 8 : grafana (RLSA-2022:7519)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7519 advisory. - Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which...

PT-2022-26148 · Unknown · Opensearch

Name of the Vulnerable Software and Affected Versions: OpenSearch versions prior to 1.3.7 OpenSearch versions prior to 2.4.0 Description: There is an issue with the implementation of fine-grained access control rules, including document-level security, field-level security, and field masking, whe...

CVE-2022-28169

CVE-2022-28169 affects Brocade Fabric OS Webtools. A low-privilege Webtools user could elevate privileges to admin by crafting a request that creates an admin account using the operator’s session. Public details specify this occurs in Fabric OS versions prior to v9.1.1, v9.0.1e, and v8.2.3c. A mi...

SideFX: Stored XSS in messages

The security issue described involves a stored cross-site scripting XSS vulnerability in the message functionality of the system. The vulnerability allowed an attacker to inject malicious code into messages, which could be executed when the victim viewed the message. This resulted in the attacker...

CVE-2021-3779

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...

Access Restriction Bypass in go-ldap

In the ldap.v2 aka go-ldap package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: 1 it relies only on the return error of the Bind function call to determine whether a user is...

Information Disclosure

github.com/grafana/grafana is vulnerable to information disclosure. An authenticated attacker is able to view confidential data by querying for a specific team ID because the the library exposes multiple API endpoints without proper user authorization, allowing a malicious user to gain access to...

CVE-2022-21713

Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. /teams/:teamId will allow an authenticated attacker to view unintended data by querying for the specific team ID,...

CVE-2022-21713

Grafana CVE-2022-21713 is an information-disclosure issue due to improper authorization handling on Teams API endpoints. Specifically, an authenticated user could access data via /teams/:teamId, enumerate teams via /teams/:search, or view team members via /teams/:teamId/members when editors_can_a...

Servisnet Tessa Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Servisnet Tessa - Privilege Escalation Metasploit', 'Description' = %q This module exploits privilege escalation in Servisnet Tessa, triggered by...

GHSA-M434-M5PV-P35W Insufficient user authorization in Moodle

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events...

Insufficient user authorization in Moodle

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability...

NVIDIA GeForce Experience < 3.24.0.126 Local Privilege Escalation

NVIDIA GeForce Experience, all versions prior to 3.24.0.126, contain a vulnerability in user authorization, where GameStream does not correctly apply individual access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosur...

CVE-2021-41598 UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is Github an open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from a UI...