CVE-2024-2913 Race Condition Vulnerability in mintplex-labs/anything-llm

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user...

PT-2024-22751 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm affected versions not specified Description: A race condition vulnerability exists in the user invite acceptance process, allowing attackers to create multiple user accounts from a single invite link by sending multiple concurren...

GHSA-XXC6-35R7-796W Possible injection of HTML into user invite mails

Impact A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Explanation of the vulnerability A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message...

Possible injection of HTML into user invite mails

Impact A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Explanation of the vulnerability A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message...

Automattic: Remote Code Execution in Wordpress Desktop

An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...

Code injection

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

CVE-2017-15611

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

CVE-2017-15611

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

Inflection: Limited arbitrary text inclusion in user invite emails

When creating a GoodHire account, a fairly wide range of ASCII characters are permitted in certain fields like Company Name. This field is included in email templates that are automatically sent to new users when an account owner invites them to join a GoodHire account. Theoretically, spam conten...

berlinersingles.de XSS vulnerability

Vulnerable URL: https://www.berlinersingles.de/user/invite/registered Details: Description| Value ---|--- Patched:| No Latest check for patch:| 06.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 401131 VIP website status:| No Check berlinersingles.de SSL...