CVE-2024-35311

Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control...

PT-2024-11604 · Intel · Intel Thunderbolt Dch Drivers

Name of the Vulnerable Software and Affected Versions: IntelR Thunderbolt driver software versions prior to 89 Description: The issue is related to improper access control in some IntelR Thunderbolt driver software, which may allow an authenticated user to potentially enable escalation of privile...

PT-2024-18765 · Unknown · Multitasking Framework

Name of the Vulnerable Software and Affected Versions: multitasking framework versions prior to SMR May-2024 Release 1 Description: The issue is related to improper access control in the multitasking framework, allowing physical attackers to access an unlocked screen for a period of time...

PT-2024-24124 · Unknown · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP CRM versions 19.0.0 and before Description: The issue allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover. Thi...

PT-2024-23076

Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...

PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt affected versions not specified Description: The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the...

CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

CVE-2024-25811

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information...

CVE-2024-28735

Unit4 Financials by Coda versions prior to 2023Q4 are susceptible to an incorrect access control authorization bypass vulnerability. An authenticated user with a valid account—regardless of their profile—can modify the password of any other user in the application by sending a crafted POST reques...

PT-2024-2618 · NetGear · Netgear Cbr40 +1

Name of the Vulnerable Software and Affected Versions: Netgear CBR40 version 2.5.0.28 Netgear CBK40 version 2.5.0.28 Netgear CBK43 version 2.5.0.28 Description: The issue is related to an information leak in the currentsetting.htm component, which allows attackers to obtain sensitive information...

PT-2024-20679 · Unknown · Skysea Client View

Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2 Description: An improper access control issue exists in the resident process of SKYSEA Client View. This issue can be exploited to execute an arbitrary process with SYSTEM privileg...

CVE-2024-22889

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request...

CVE-2024-25811

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. This vulnerability stems from an Access Control Error within the content management system. No information regarding a patched version or specific remediation is currently provi...

CVE-2024-20325

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations o...

Authentication flaw

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

CVE-2023-47422

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

CVE-2023-47422

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

CVE-2023-27303

Improper access control in some IntelR ThunderboltTM DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2023-25073

Improper access control in some IntelR DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local access...

PT-2024-11056 · Meinberg · Meinberg Lantime-Firmware

Name of the Vulnerable Software and Affected Versions: Meinberg LANTIME-Firmware versions prior to 6.24.029 Meinberg LANTIME-Firmware versions 7 prior to 7.04.008 Description: An issue was discovered in the LTOS-Web-Interface of Meinberg LANTIME-Firmware, where an admin can delete required user...