FileCloud NTFS access control

A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960.

Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.

Leaking password protected articles content due to improper access control in publify/publify

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.

Openshift-Gitops: Improper access control allows admin privilege escalation

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

Improper Access Control to Remote Code Execution in webmin/webmin

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Improper Access Control (IDOR) in dolibarr/dolibarr

Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

Improper Access Control in chocobozzz/peertube

Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.

Improper Access Control in publify/publify

Improper Access Control in GitHub repository publify/publify prior to 9.2.8.

Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover

The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.

Improper Access Control in janeczku/calibre-web

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

Improper Access Control in janeczku/calibre-web

Improper Access Control in Pypi calibreweb prior to 0.6.16.

Improper header sanitization in bored-agent causes escalation of privilege

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.

Improper Access Control in crater-invoice/crater

Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.

Improper Access Control in chocobozzz/peertube

peertube is vulnerable to Improper Access Control

Improper Access Control in chocobozzz/peertube

peertube is vulnerable to Improper Access Control

ghostlander Halcyon Block Verification main.cpp AddToBlockIndex access control

A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The identifier of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability.

Improper Access Control in bookstackapp/bookstack

bookstack is vulnerable to Improper Access Control

Improper Access Control in bookstackapp/bookstack

bookstack is vulnerable to Improper Access Control

Improper Access Control in snipe/snipe-it

snipe-it is vulnerable to Improper Access Control