1480 matches found
CVE-2022-34574
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini...
CVE-2022-34575
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml...
CVE-2022-34574: Direct Request
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini...
PT-2022-22212 · Wavlink · Wavlink Wifi-Repeater Rpta2-77W
Name of the Vulnerable Software and Affected Versions: Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 Description: An access control issue allows attackers to arbitrarily configure device settings via accessing the page "mb wifibasic.shtml". Recommendations: For Wavlink WiFi-Repeater...
CVE-2022-34573: Direct Request
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mbwifibasic.shtml...
Design/Logic Flaw
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator...
CVE-2022-34112
CVE-2022-34112 describes an access-control flaw in DataEase v1.11.1 where non-admin users can arbitrarily uninstall the plugin via /api/plugin/uninstall. The issue’s root cause is improper permission checks on the uninstall endpoint, enabling privilege escalation to perform a destructive action. ...
CVE-2022-34112: Incorrect Permission Assignment for Critical Resource
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator...
CVE-2022-32430
An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application...
CVE-2022-34046
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...
Design/Logic Flaw
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data...
CVE-2022-34047
CVE-2022-34047 affects WAVLINK WN530HG4 (M30HG4.V5030.191116). The issue is an improper access control in the set_safety.shtml?r=52300 endpoint, where an attacker can view the page source (view-source:) and search for var syspasswd to obtain usernames and passwords. Evidence in connected docs not...
CVE-2022-34047: Exposure of Resource to Wrong Sphere
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd...
CVE-2022-34046: Incorrect Authorization
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...
CVE-2022-24689
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages including personal data without being authenticated. The collected information includes the badge numbers that operate as user login...
Microsoft Azure Site Recovery 权限许可和访问控制问题漏洞
Microsoft Azure Site Recovery is a site recovery DRaaS from the U.S. company Microsoft for cloud and hybrid cloud architectures. Microsoft Azure Site Recovery elevation of privilege vulnerability can be exploited by attackers to gain elevated privileges on the system...
Microsoft Azure Site Recovery 权限许可和访问控制问题漏洞
Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation USA. Microsoft Azure Site Recovery has an elevation of privilege vulnerability, and no details of the vulnerability are available...
CVE-2022-32290
The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...
CVE-2022-32310: Incorrect Authorization
An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php...