1440 matches found
Cross site request forgery (csrf)
An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...
PT-2022-25045 · Facm · Facm
Name of the Vulnerable Software and Affected Versions: FACM application versions prior to SMR Oct-2022 Release 1 Description: The issue is related to improper access control in the FACM application, allowing a local attacker to connect arbitrary AP and Bluetooth devices. Recommendations: For...
PT-2022-23866 · Chipolo · Chipolo One Bluetooth Tracker +1
Name of the Vulnerable Software and Affected Versions: Chipolo ONE Bluetooth tracker 2020 version 4.13.0 Chipolo iOS app version 4.13.0 Description: The issue concerns Incorrect Access Control, allowing access revocation evasion attacks. Once a malicious sharee obtains access credentials, Chipolo...
PT-2022-7292 · Cri-O +2 · Cri-O +2
Name of the Vulnerable Software and Affected Versions: CRI-O affected versions not specified Description: The issue is related to the incorrect handling of supplementary groups in the CRI-O container engine, which may lead to sensitive information disclosure or possible data modification. This ca...
PT-2022-23655 · Samsung · Samsung Pass
Name of the Vulnerable Software and Affected Versions: Samsung pass versions prior to 4.0.03.1 Description: The issue is related to improper access control in Samsung pass, allowing physical attackers to access data on a certain state of an unlocked device. Recommendations: For versions prior to...
CVE-2022-36542
An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data...
PT-2022-23454
Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description An access control issue in the component /ip/admin/ allows attackers to arbitrarily edit, read, and delete Administrator data. Recommendations For Edoc-doctor-appointment-system version...
CVE-2022-26017
Improper access control in the IntelR DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access...
Emerson Proficy Machine Edition 安全漏洞
Emerson Proficy Machine Edition is a software application from Emerson Electric USA, Inc. an automation solution. A security vulnerability exists in Emerson Proficy Machine Edition version 9.00 and prior versions, which stems from storing project data in a directory with incorrect access control...
PT-2022-19210 · Zoom · Zoom On-Premise Meeting Connector Mmr
Name of the Vulnerable Software and Affected Versions: Zoom On-Premise Meeting Connector MMR versions prior to 4.8.129.20220714 Description: The issue allows a malicious actor to join a meeting without appearing to other participants, admit themselves from the waiting room, become the host, and...
PT-2022-21914 · Dell · Dell Wyse Management Suite
Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions 3.6.1 and below Description: The issue is related to improper access control in the UI, allowing a remote authenticated attacker to bypass access controls and download reports containing sensitive...
CVE-2022-34572
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt...
Design/Logic Flaw
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini...
CVE-2022-34574
The CVE-2022-34574 issue affects Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19. Root cause: an access control flaw in the device allows an attacker to obtain key information by accessing the Tftpd32.ini file. Impact per sources: leakage of critical device information. Practical remediatio...
CVE-2022-34574
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini...
CVE-2022-34575
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml...
PT-2022-22212 · Wavlink · Wavlink Wifi-Repeater Rpta2-77W
Name of the Vulnerable Software and Affected Versions: Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 Description: An access control issue allows attackers to arbitrarily configure device settings via accessing the page "mb wifibasic.shtml". Recommendations: For Wavlink WiFi-Repeater...
Design/Logic Flaw
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator...
CVE-2022-34112
CVE-2022-34112 describes an access-control flaw in DataEase v1.11.1 where non-admin users can arbitrarily uninstall the plugin via /api/plugin/uninstall. The issue’s root cause is improper permission checks on the uninstall endpoint, enabling privilege escalation to perform a destructive action. ...
