38 matches found
CVE-2021-25253
Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 Cliente de Trend Micro OfficeScan: Las versiones icacls "C:\Program Files x86\Trend Micro\OfficeScan Clien...
KINGSOFT-WPS-Office-LPE
JVN Advisory https://jvn.jp/en/vu/JVNVU90673830/ The following CVE number have been assigned: CVE-2022-25943 KINGSOFT WPS Office LPE WPS Office is an office suite for Microsoft Windows, macOS, Linux, iOS, Android, and HarmonyOS developed by Zhuhai-based Chinese software developer Kingsoft...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell Fix This powershell script fixes CVE-2021-36934, based on the original script of Joran Slingerland https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 The Powershell script will do following:...
CVE-2020-10551
CVEID : CVE-2020-10551 Name of the affected products and versions : QQBrowser all versions prior to 10.5.3870.400 Problem type : CWE-284: Improper Access Control Summary QQBrowser is a web browser developed by Tencent. It is one of the most popular web browsers used in China. During our tests, we...
CVE-2026-91085 Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...
CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
EUVD-2026-72322
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...
CVE-2026-52766
YesWiki (PHP-based wiki system) is vulnerable to unauthenticated arbitrary page deletion prior to version 4.6.6 . The {{erasespamedcomments}} action (actions/EraseSpamedCommentsAction.php) processes a suppr[] array from POST and deletes pages whose tags match, with no authorization check in the a...
CVE-2026-72840
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...
CVE-2026-72840
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...
Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET diagnostics IPC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A missing error check in .NET causes an...
CVE-2026-41115
A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMERGROUPDESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists ACLs,...
CVE-2026-41115
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
CVE-2026-41115
Apache Kafka contains an improper authorization vulnerability (CWE-285) in the CONSUMER_GROUP_DESCRIBE (69) API. The discrepancy exists because the API validates the DESCRIBE operation on the GROUP resource, while official documentation and KIP-848 specify READ . While the current implementation ...
WordPress plugin Woocommerce Envato Affiliates 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
Linux Distros Unpatched Vulnerability : CVE-2026-24413
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set...
MiracleLinux 7 : pki-core-10.5.1-13.1.el7 (AXSA:2018-3231:02)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3231:02 advisory. pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access CVE-2018-1080 Tenable has extracted the preceding...
PT-2025-43771
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through = 3.5.3...