Vulnerability in Istio

Istio 1.1.x through 1.1.6 has Incorrect Access Control...

Microsoft Windows Common Log File System Driver权限许可和访问控制问题漏洞

The Microsoft Windows Common Log File System Driver is Microsoft's Common Log File System CLFS API that provides a high-performance, general-purpose log file subsystem that can be used by specialized client applications and shared by multiple clients to optimize logging and access. access. A...

SUSE-SU-2022:0328-1 Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94147 fixes several issues. The following security issues were fixed: - CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a long jump over an instruction sequence where inner instructions require substantial...

SUSE-SU-2022:0325-1 Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94141 fixes several issues. The following security issues were fixed: - CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a long jump over an instruction sequence where inner instructions require substantial...

CVE-2021-44838

An issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a POST request indicating the risk to access with the id parameter, it is possible for users to access risks of other companies...

Microsoft Windows Active Directory权限许可和访问控制问题漏洞

Microsoft Windows Active Directory is a centralized directory management service responsible for architecting medium- to large-scale network environments from the U.S. company Microsoft. Stores information about objects on the network and makes it easy for administrators and users to find and use...

PT-2022-9371 · Philips · Engage

Name of the Vulnerable Software and Affected Versions: Product affected versions not specified Description: The issue concerns an improper access control, potentially allowing an authenticated user to gain unauthorized access to sensitive data. Recommendations: At the moment, there is no...

The vulnerability of the SD-WAN system “Bohatka,” related to lack of access control, allows a hacker to execute any arbitrary code on the system’s server.

The vulnerability of the SD-WAN system “Bohatka” is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the system’s server, after successful authentication via WebSocket...

PT-2022-11301 · Alt Linux · Alt Linux

Name of the Vulnerable Software and Affected Versions: ALT Linux affected versions not specified Description: The issue is related to insufficient capability checks, allowing teachers to download users outside of their courses. This suggests a problem with access control or permissions within the...

PT-2021-23998 · Laravel · Laravel Ignition

Name of the Vulnerable Software and Affected Versions: Laravel Ignition component versions prior to 1.16.15 Laravel Ignition component versions 2.0.x prior to 2.0.6 Description: The issue concerns the "fix variable names" feature in the Ignition component for Laravel, which can lead to incorrect...

PT-2021-21922 · Binatone · Motorola-Branded Binatone Hubble Cameras

Name of the Vulnerable Software and Affected Versions: Motorola-branded Binatone Hubble Cameras affected versions not specified Description: An improper access control issue was reported, allowing an unauthenticated attacker on the same network as the device to access administrative pages. This...

Microsoft Windows Storage Spaces Controller 权限许可和访问控制问题漏洞

Microsoft Windows Storage Spaces Controller is an essential driver for providing storage space functionality from Microsoft Corporation USA. A vulnerability exists in Microsoft Windows Storage Spaces Controller with privilege permission and access control issues. The following products and editio...

PT-2021-14923 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.12 through 14.0.8 GitLab versions 14.1 through 14.1.3 GitLab versions 14.2 through 14.2.1 Description: The issue concerns missing access control in GitLab with Jira Cloud integration enabled, allowing Jira users without...

Trend Micro Apex One 和 Worry-Free Business Security 权限许可和访问控制问题漏洞

Trend Micro Apex One and Trend Micro Worry-Free Business Security are both products of Trend Micro, Inc.Trend Micro Apex One is a suite of endpoint security software that provides automated threat detection and response.Trend Micro Worry-Free Business Security is an enterprise-class information...

PT-2021-15242 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.0.0 through 3.0.15 GitHub Enterprise Server versions 3.1.0 through 3.1.7 Description: An improper access control issue in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner...

PT-2021-16099 · WordPress · Timetable/Event Schedule

Name of the Vulnerable Software and Affected Versions: Timetable and Event Schedule WordPress plugin versions prior to 2.4.2 Description: The issue concerns a lack of proper access control and the absence of a CSRF check, allowing any user with the edit posts capability to delete arbitrary...

Microsoft Windows Event Tracing 权限许可和访问控制问题漏洞

Microsoft Windows Event Tracing is an application from Microsoft Corporation USA. It provides a mechanism for tracking and logging events raised by user-mode applications and kernel-mode drivers. Microsoft Windows Event Tracing is vulnerable to privilege permission and access control issues. The...

Microsoft Windows SMB Client 权限许可和访问控制问题漏洞

Microsoft Windows SMB Client is a Microsoft application. An SMB Client. Microsoft Windows SMB Client is vulnerable to privilege permission and access control issues. The following products and editions are affected:Windows 10 Version 21H1 for ARM64-based Systems,Windows 10 Version 21H1 for 32-bit...

Apple macOS 权限许可和访问控制问题漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A vulnerability exists in Apple macOS Monterey prior to version 12.1 with privilege permission and access control issues, which stems from a logic issue that could lead to...

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

The plugin does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in wit...