3189 matches found
CVE-2025-21011
Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors...
CVE-2025-46391
CWE-284: Improper Access Control...
CVE-2025-46391
CWE-284: Improper Access Control...
CVE-2025-21011
Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors...
PT-2025-32113 · Samsung · Galaxy Wearable
Name of the Vulnerable Software and Affected Versions: Galaxy Wearable versions prior to 2.2.63.25042861 Description: Improper access control in Galaxy Wearable allows local attackers to access sensitive information. Recommendations: Update Galaxy Wearable to version 2.2.63.25042861 or later...
PT-2025-31953 · Unknown · Agenzia Impresa Eccobook
Name of the Vulnerable Software and Affected Versions: Agenzia Impresa Eccobook versions 2.81.1 Description: An incorrect access control issue exists in CaricaVerbale within Agenzia Impresa Eccobook. Authenticated attackers with low-level access can escalate privileges to Administrator...
CVE-2025-50870
The CVE-2025-50870 affects Institute-of-Current-Students version 1.0, where the mydetailsstudent.php endpoint's myds GET parameter accepts an email and returns the corresponding student’s personal information without validating the requester’s identity or permissions. This Incorrect Access Contro...
CVE-2025-50870
Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the...
CVE-2025-28170
Grandstream Networks GXP1628 =1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files...
PT-2025-31526 · Exagrid · Exagrid Ex10
Name of the Vulnerable Software and Affected Versions: ExaGrid EX10 versions 6.3 through 7.0.1.P08 Description: The software is susceptible to incorrect access control. Users with operator-level privileges can retrieve SMTP credentials, including plaintext passwords, by issuing an HTTP request to...
CVE-2025-26062
An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings...
CVE-2025-28170
Grandstream Networks GXP1628 =1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files...
Missing Authentication
backend.ai is vulnerable to Missing Authentication. The vulnerability is due to improper access control caused by lack of authentication checks in the registration feature, allowing arbitrary users to create accounts and access private data even when registration is disabled...
MikroTik RouterOS <= 7.19.3 Access Control Vulnerability
MikroTik RouterOS is prone to an access control vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:mikrotik:routeros"...
WordPress Realty Portal – Agent plugin <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function vulnerability
Missing Authorization to Authenticated Subscriber+ Privilege Escalation via rpuserprofile Function vulnerability discovered by theviper17y in WordPress Plugin Realty Portal – Agent versions = 0.3.9...
CVE-2025-6741
CVE-2025-6741 describes improper access control in the Devolutions Server secure message component, enabling an authenticated user to steal unauthorized entries via the secure message entry attachment feature. Affected are Devolutions Server 2025.2.2.0–2025.2.4.0 and 2025.1.11.0 and earlier. Root...
GHSA-9G4J-V8W5-7X42 Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources
Summary Deactivated users that had either enrolled via OAuth/SAML or had their account connected to an OAuth/SAML account can still partially access authentik even if their account is deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can...
PT-2025-30494 · Duracomm · Duracomm Spm-500 Dp-10In-100-Mu
Name of the Vulnerable Software and Affected Versions: DuraComm SPM-500 DP-10iN-100-MU affected versions not specified Description: The device lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device. Recommendation...
CVE-2025-52166
Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information...