CVE-2023-5194 A system/user manager can demote / deactivate another manager

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...

CVE-2023-5194 A system/user manager can demote / deactivate another manager

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...

CVE-2023-5159 A User Manager role with user edit permissions could manage/update bots

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...

CVE-2023-5159 A User Manager role with user edit permissions could manage/update bots

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...

CVE-2023-5159

Mattermost (CVE-2023-5159) describes an improper permissions check when managing or updating a bot, allowing a User Manager with user-edit rights to manage/update bots. Affected component: bot permission verification logic; root cause: insufficient permission verification. Impact stated: privileg...

PT-2023-31858 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to properly verify permissions when managing or updating a bot. This allows a User Manager role with user edit permissions to manage or update...

GHSA-6XJJ-V76V-FWPJ Mattermost does not validate requesting user permissions before updating admin details

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

Mattermost does not validate requesting user permissions before updating admin details

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

Code injection

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

CVE-2021-33223

An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file...

PT-2023-12199 · Seeddms · Seeddms

Name of the Vulnerable Software and Affected Versions: SeedDMS version 6.0.15 Description: An issue in SeedDMS allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file. Recommendations: For SeedDMS version 6.0.15, consider restricting access to the...

The vulnerability of the CmpUserMgr component in the Codesys industrial automation software suite allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CmpUserMgr component in the Codesys industrial automation software suite is related to the use of a unreliable cryptographic algorithm. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Screen SFT DAB 600/C - Authentication Bypass Admin Password Change Exploit

!/usr/bin/env python3 Exploit Title: Screen SFT DAB 600/C - Authentication Bypass Admin Password Change Exploit Author: LiquidWorm Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com...

CVE-2022-20497

In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorrect state transition. This could lead to local information disclosure with physical access required and an app that runs above the...

WordPress plugin WP User Manager Information Disclosure Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

CVE-2021-24655

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...

CVE-2021-24655

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...

CVE-2021-24655

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...