PT-2025-33514 · Unknown · Buttercup Buttercup-Browser-Extension

Name of the Vulnerable Software and Affected Versions: Buttercup buttercup-browser-extension versions up to 0.14.2 Description: A vulnerability exists in Buttercup buttercup-browser-extension up to version 0.14.2 due to improper access controls. The issue is remotely exploitable, but the complexi...

CVE-2017-20199 Buttercup buttercup-browser-extension Vault access control

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...

CVE-2017-20199

Buttercup buttercup-browser-extension

CVE-2017-20199 Buttercup buttercup-browser-extension Vault access control

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...

CVE-2024-10219

An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints...

CVE-2025-54717

CVE-2025-54717 affects the WordPress WP Membership plugin (versions up to 1.6.3). It is a Missing Authorization flaw due to incorrectly configured access control security levels, enabling a settings change vulnerability. Remediation: upgrade WP Membership to a version later than 1.6.3 (per Patchs...

CVE-2025-55716

CVE-2025-55716 concerns the WordPress plugin WP Statistics (versions up to 14.15). The issue is described as a Missing Authorization vulnerability due to incorrectly configured access control levels, enabling unauthorized actions without user interaction. The CVSS 3.1 base metrics indicate a Netw...

AZL-66300 CVE-2025-8713 affecting package postgresql for versions less than 16.10-1

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

CVE-2025-8713 PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

CVE-2025-8713 PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via optimizer statistics. An attacker can access sensitive sampled data by querying views, partitions, or child tables by crafting a leaky operator that bypasses view access control lis...

CVE-2025-50031

Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DB Backup: from n/a through = 6.0...

IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security

IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...

CVE-2025-28962

CVE-2025-28962: WordPress/ plugin "Advanced Google Universal Analytics" (stefanoai) has a Missing Authorization vulnerability. The issue arises from misconfigured access control levels, enabling unauthorized access to potentially sensitive data. Affected software versions: Advanced Google Univers...

CVE-2025-52721 WordPress Global Gallery Plugin <= 9.2.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3...

PT-2025-33165 · WordPress · Wp Lead Capturing Pages

Name of the Vulnerable Software and Affected Versions: WP Lead Capturing Pages versions prior to 2.3 Description: A missing authorization issue exists in kamleshyadav WP Lead Capturing Pages due to incorrectly configured access control security levels. Recommendations: Update WP Lead Capturing...

Vulnerability in core server (CVE-2025-8713)

PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intende...

CVE-2024-10219

GitLab CVE-2024-10219 affects GitLab CE/EE versions 15.6–before 18.0.6, 18.1–before 18.1.4, and 18.2–before 18.2.2. The issue allows authenticated users to bypass access controls and download private artifacts by abusing certain API endpoints. Mitigation requires upgrading to the fixed releases: ...

CVE-2024-10219

Removed by vendor...

CVE-2024-10219 Incorrect Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints...