ROS-20250717-02

Vulnerability of the auxiliary ticket escalation tool in the Escalade GLPI plugin is related to incorrect access controls. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive information...

Security Bulletin: IBM Sterling Connect:Direct for Unix is vulnerable to various attacks due to IBM Runtime Environment Java Technology Edition Version 17

Summary IBM Java 17 is used by IBM Sterling Connect:Direct for UNIX in product configuration and data transmission. IBM Sterling Connect:Direct for UNIX is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct for UNIX has upgraded IBM Java 17 to address the issues. Vulnerabilit...

CVE-2025-53709 Access control issues impacting secure-upload service

Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily...

CVE-2025-53709 Access control issues impacting secure-upload service

Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily...

PT-2025-28476 · Ivanti · Ivanti Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 Ivanti Policy Secure versions prior to 22.7R1.5 Description: The issue is related to improper access control in the certificate management component. This allows a remote authenticated admin wi...

PT-2025-28234 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.3 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Description: A low-privileged user without the "admin" or "power" Splunk...

CVE-2025-29007

Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through = 3.4...

CVE-2025-47819

Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control...

Moodle 4.3.x < 4.3.12 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.18 or 4.3.x prior to 4.3.12 or 4.4.x prior to 4.4.8 or 4.5.x prior to 4.5.4. It is, therefore, affected by multiple vulnerabilities : - Additional checks were required to ensure users can on...

CVE-2025-49988 WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability

Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through = 0.1.40...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager (CVE-2025-21587, CVE-2025-30698, CVE-2025-4447)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote attacke...

CVE-2025-49857

CVE-2025-49857 concerns the WordPress plugin myCred (WP plugin) with versions up to and including 2.9.4.2. The initial description and connected Red Hat/RedTeam-style sources indicate a Missing Authorization / Broken Access Control vulnerability, arising from incorrectly configured access control...

CVE-2025-48147 WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through = 2.1.2...

CVE-2025-49289

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.5.0...

CVE-2025-30957

Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through = 1.1.2...

CVE-2025-30624

CVE-2025-30624 (WordLift) is a Missing Authorization vulnerability in the WordLift WordLift WordPress plugin. The issue stems from incorrectly configured access control security levels. Affected versions are from n/a through 3.54.4. CVSS v3.1 base score is 4.3 (Medium) with vectors AV:N/AC:L/PR:L...

CVE-2025-30945

CVE-2025-30945 — Affected: Taskbuilder (WordPress plugin)

CVE-2025-30978

CVE-2025-30978 : Missing Authorization in the Slack Notifications by dorzki WordPress plugin (versions from n/a to 2.0.7) due to incorrectly configured access control levels. The vulnerability has a CVSS v3.1 base score of 4.3 (Medium) with network attack vector and low privilege/complexity requi...

CVE-2025-49287

CVE-2025-49287 : A Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce affects Product Feed for WooCommerce (Google Shopping Feed, Pinterest Feed, TikTok Ads & More) up to version 2.2.8. The CVSSv3.1 base score is 4.3 (Medium); attack vector is network, with low attack c...

Mattermost Server 9.11.x < 9.11.13 / 10.5.x < 10.5.4 / 10.7.x < 10.7.1 Multiple Vulnerabilities (MMSA-2025-00457, MMSA-2025-00462)

The version of Mattermost Server installed on the remote host is prior to 9.11.13, 10.5.4, or 10.7.1. It is, therefore, affected by multiple vulnerabilities as referenced in the MMSA-2025-00457 and MMSA-2025-00462 advisories. - Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.1...