CVE-2024-12235

A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerability is the function doFilter of the file...

CVE-2024-12235 Shenzhen Dashi Tongzhou Information Technology AgileBPM AuthorizationTokenCheckFilter.java doFilter access control

A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerability is the function doFilter of the file...

CVE-2024-49581 Access control issue impacting RV backed objects

Restricted Views backed objects OSV1 could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available...

PT-2024-31891 · Unknown · Openvidreview

Name of the Vulnerable Software and Affected Versions: OpenVidReview version 1.0 Description: The issue concerns incorrect access control. Specifically, the "/upload" API endpoint is accessible without authentication, allowing any user to upload files. Recommendations: For OpenVidReview version...

CVE-2024-40408

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges...

CVE-2024-40404

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established...

CVE-2024-46948

Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control...

Lack of proper access control on endpoint to delete evaluators

Description The /v1/evaluators/ route allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. The current implementation: Does not...

PT-2024-30382 · Woocommerce · Persian Woocommerce Sms

Name of the Vulnerable Software and Affected Versions: Persian WooCommerce versions 7.1.6 and earlier Description: The issue affects Persian WooCommerce due to a Missing Authorization vulnerability. This vulnerability allows accessing functionality not properly constrained by ACLs. Recommendation...

PT-2024-34196 · Cloudways · Cloudways Breeze

Name of the Vulnerable Software and Affected Versions: Cloudways Breeze versions 2.1.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Cloudways Breeze, which allows exploitation due to incorrectly configured access control security levels...

PT-2024-33048 · Wtcms · Wtcms

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue is related to Incorrect Access Control in the CommonControllerHomebaseController.class.php file. Recommendations: For WTCMS version 1.0, consider restricting access to the HomebaseController.class.php...

CVE-2024-44331

Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of service via a series of specially crafted hexstream requests...

Information Disclosure

typo3/cms-backend is vulnerable to Information Disclosure. The vulnerability is due to improper access control configuration, which allows backend users to see items in the page tree for restricted pages if no mounts were configured, exposing restricted content to unauthorized users...

PT-2024-6775 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.5 through 17.2.9 GitLab EE versions 17.3 through 17.3.5 GitLab EE versions 17.4 through 17.4.2 Description: The issue is related to errors in access control, allowing a remote attacker to run Continuous...

PT-2024-32073 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: An access control issue in the CheckVip function in UserController.java of IceCMS allows unauthenticated attackers to access and return all user information, including passwords. Recommendations:...

CVE-2024-46609

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords...

PT-2024-6316 · Veeam · Veeam One

Name of the Vulnerable Software and Affected Versions: Veeam ONE affected versions not specified Description: An improper access control issue allows low-privileged users to execute code with Administrator privileges remotely. This vulnerability is related to deficiencies in access control in the...

CVE-2024-45233

An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins...

PT-2024-30145 · Unknown · Kashipara Hotel Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Hotel Management System version 1.0 Description: An Incorrect Access Control issue was found in the /admin/delete room.php endpoint, allowing an unauthenticated attacker to delete valid hotel room entries in the administrator sectio...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices SMR Aug-2024 Release 1 prior to version 1, which stems from an improper access control issue...