327 matches found
CVE-2024-0047
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for...
PT-2024-15320 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: A logic error in the code of UserManagerService.java causes device policies to be serialized with an incorrect tag. This can lead to a local denial of service when policies are deserialized...
PT-2023-13355 · Unknown · Rws Worldserver
Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions prior to 11.7.3 Description: An issue was discovered that allows regular users to create users with the Administrator role via UserWSUserManager. This enables unauthorized elevation of privileges. Recommendations: For...
Privilege Escalation
mattermost is vulnerable to Privilege Escalation. Mattermost fails to properly verify the bot permissions, allowing a User Manager role with user edit permissions to manage/update bots...
Mattermost Incorrect Authorization vulnerability
Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...
Mattermost Incorrect Authorization vulnerability
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...
CVE-2023-5194
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...
Design/Logic Flaw
Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...
CVE-2023-5194 A system/user manager can demote / deactivate another manager
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...
CVE-2023-5194 A system/user manager can demote / deactivate another manager
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...
CVE-2023-5159 A User Manager role with user edit permissions could manage/update bots
Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...
CVE-2023-5159 A User Manager role with user edit permissions could manage/update bots
Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...
CVE-2023-5159
Mattermost (CVE-2023-5159) describes an improper permissions check when managing or updating a bot, allowing a User Manager with user-edit rights to manage/update bots. Affected component: bot permission verification logic; root cause: insufficient permission verification. Impact stated: privileg...
PT-2023-31858 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to properly verify permissions when managing or updating a bot. This allows a User Manager role with user edit permissions to manage or update...
GHSA-6XJJ-V76V-FWPJ Mattermost does not validate requesting user permissions before updating admin details
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...
Mattermost does not validate requesting user permissions before updating admin details
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...
Code injection
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...
CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...
CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...