Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.
The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions 5.10 through 5.36, USG20(W)-VPN series firmware versions 5.10 through 5.36, and VPN series firmware versions 5.00 through 5.36. An unauthenticated, LAN-based attacker could leverage the vulnerability to inject some operating system (OS) commands into the device…
Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <=Â 3.11.9 versions.
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <=Â 1.0.9 versions.