UBUNTU-CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

PostgreSQL row security below e.g. subqueries disregards user ID changes

...

PT-2024-71: Predictable format of user identifiers in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. Web application uses an unreliable algorithm for generating user account IDs. As a result, an intruder can predict existing identifiers within the application to carry out attacks targeting the authentication mechanism...

CVE-2022-30361

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, roles, user type, license type, and personal detai...

PT-2024-32710 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: This issue exists due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this by including multiple userid...

Broadcom Symantec Privileged Access Management 安全漏洞

Broadcom Symantec Privileged Access Management Broadcom Symantec PAM is a security software from Broadcom, Inc. It helps prevent security breaches by protecting sensitive administrative credentials, controlling privileged user access, proactively enforcing security policies, and monitoring and...

python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django

A flaw was found in social-auth-app-django. In affected versions of this package, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match...

PT-2024-40029 · Catalyst · Sentry

Name of the Vulnerable Software and Affected Versions: OpenCFP affected versions not specified Description: The issue concerns the third-party authentication framework Sentry, developed by Cartalyst, which is used in OpenCFP. It stems from how Sentry handles password reset checks, specifically wh...

UBUNTU-CVE-2024-32879

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed b...

GHSA-2GR8-3WC7-XHJ3 social-auth-app-django affected by Improper Handling of Case Sensitivity

Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix...

UBUNTU-CVE-2024-26822

In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the...

CVE-2024-1760

creationtimestamp| type| source ---|---|--- 2024-03-06 07:26:44+00:00| seen| https://t.me/ctinow/201061 2024-03-06 07:31:10+00:00| seen| https://t.me/ctinow/201065...

GHSA-CP68-QRHR-G9H8

creationtimestamp| type| source ---|---|--- 2024-02-21 01:17:04+00:00| seen| https://t.me/ctinow/189082 2024-02-21 21:09:54+00:00| seen| https://t.me/arpsyndicate/3859 2025-04-22 17:03:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12897...

alf.io Security Vulnerabilities

alf.io is open source ticket reservation system. A security vulnerability exists in alf.io versions prior to 2.0-Mr-2402. An attacker can exploit the vulnerability to view user ID details, especially the API KEY in the username...

Improper access control

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number...

PT-2024-12183 · Skoda · Skoda Automotive Cloud

Name of the Vulnerable Software and Affected Versions: Skoda Automotive cloud affected versions not specified Description: The issue allows attackers to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number, due to a Broken Access...

Skoda Security Breach

Skoda is a line of automobiles from Skoda Inc. A security vulnerability exists in Skoda Automotive that originates from allowing access to user nicknames and identifiers by specifying arbitrary vehicle VIN numbers...

CVE-2023-40290

creationtimestamp| type| source ---|---|--- 2023-10-06 08:11:16+00:00| seen| https://t.me/thehackernews/3973 2023-10-06 09:18:47+00:00| seen| https://t.me/KomunitiSiber/895 2023-10-06 09:19:18+00:00| seen| Telegram/1ijNbUbO8yc9BpkvNnkSlSSRpt94dd66KRvmrGADFgP41g...

CVE-2021-42083

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC go to the alert manager open the ITSM tab add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss ' whitespaces are tab characters click add click apply create a test alert The tes...

Faveo 安全漏洞

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A security vulnerability exists in Faveo version 5.0.1. Attackers use the vulnerability to modify user IDs to obtain sensitive information...