| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery. |
| nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery. |
| Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. |
| In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps. |
| Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of
|
| Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager
|
| Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data |
| An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call. |
| In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In Ifaa service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.
|
| In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
| In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
