Design/Logic Flaw

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...

Improper Authorization

nilsteampassnet/teampass is vulnerable to Improper Authorization. The vulnerability allows an attacker with low-level privileges to logout everyone out including the admin due to an Insecure Direct Object References IDOR via the user ID...

CVE-2023-27569

creationtimestamp| type| source ---|---|--- 2023-03-21 19:35:04+00:00| seen| https://t.me/cibsecurity/60395...

answer 安全漏洞

answer is an open source knowledge-based community software. answer 1.0.6 prior versions of the authorization problem vulnerability , the vulnerability stems from the request to set a new password in /answer/admin/api/user/password there is improper permission management , a low-privilege attacke...

Stored Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of HTML sanitization in the the user ID when exporting to data formats supporting HTML which allows an attacker to inject and execute arbitrary JavaScript when a user clicks on the downloaded file. Not...

Stored Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to the quiz override page via the user ID which allows an attacker to inject and execute arbitrary JavaScript in the browser...

CVE-2023-21456

Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uid...

CVE-2023-28144

creationtimestamp| type| source ---|---|--- 2023-03-14 21:23:15+00:00| seen| https://t.me/cibsecurity/60021...

CVE-2023-0021

Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...

CVE-2023-24579

creationtimestamp| type| source ---|---|--- 2023-03-13 15:53:23+00:00| seen| https://t.me/cibsecurity/59889...

SUSE CVE-2023-1076

A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAPNETADMIN, it may not always be the case, e.g., a non-root user only having that...

CVE-2023-20939

creationtimestamp| type| source ---|---|--- 2023-02-28 20:27:53+00:00| seen| https://t.me/cibsecurity/59127 2025-03-21 18:20:04+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8403...

CVE-2022-47179

creationtimestamp| type| source ---|---|--- 2023-02-28 18:27:55+00:00| seen| https://t.me/cibsecurity/59111...

CVE-2015-10086

creationtimestamp| type| source ---|---|--- 2023-02-28 02:27:04+00:00| seen| https://t.me/cibsecurity/59077...

WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR

The plugin does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users. Run t...

CVE-2023-25657

creationtimestamp| type| source ---|---|--- 2023-02-22 00:47:09+00:00| seen| https://t.me/cibsecurity/58650...

CVE-2023-22228

creationtimestamp| type| source ---|---|--- 2023-02-18 00:13:32+00:00| seen| https://t.me/cibsecurity/58481 2025-03-05 20:01:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6604...

SUSE CVE-2005-3149

Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIMVANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges...

SUSE CVE-2005-3256

The key selection dialogue in Enigmail before 0.92.1 can incorrectly select a key with a user ID that does not have additional information, which allows parties with that key to decrypt the message...

SUSE CVE-2006-5871

smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings...