CVE-2023-6761

CVE-2023-6761 affects Thecosy IceCMS up to 2.0.1, where the User Data Handler’s processing allows improper access controls. The vulnerability can be exploited remotely and, per sources, the exploit has been disclosed publicly. The issue is rated HIGH (CVSSv3.1: 8.8) with network attack vector and...

CVE-2023-6758

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit...

CVE-2023-6758 Thecosy IceCMS API PlanetCommentList access control

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit...

CVE-2023-42481

In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, d...

CVE-2023-42481 Improper Access Control vulnerability in SAP Commerce Cloud

In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, d...

PT-2023-7620 · Microsoft · Windows Xaml Diagnostics +1

Name of the Vulnerable Software and Affected Versions: Windows XAML Diagnostics affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in the XAML diagnostics tool, which is associated with inadequate access restrictions. This vulnerability ca...

PT-2023-28366 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud versions HY COM 1905 through HY COM 2205, COM CLOUD 2211 Description: A locked B2B user can misuse the forgotten password functionality to un-block their user account again and re-gain access if SAP Commerce Cloud -...

Adifier System < 3.1.4 - Unauthenticated Local File Inclusion

Description The Adifier System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to 3.1.4 exclusive. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This c...

CVE-2023-6578

A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup...

SUSE CVE-2023-47106

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...

The vulnerability of the NGFW mode of the FortiOS operating system for FortiGate network devices allows attackers to circumvent existing access restrictions.

The vulnerability of the NGFW mode of the FortiOS network interface controller FortiGate relates to deficiencies in the access control list ACL mechanism. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions...

Phlox Shop <= 2.0.0 - Unauthenticated Local File Inclusion

Description The Phlox Shop plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This...

Fortinet FortiEDR Access Control Error Vulnerability (CNVD-2023-98184)

Fortinet FortiEDR is an endpoint security solution built from the ground up by Fortinet. An Access Control Error vulnerability exists in Fortinet FortiEDR Collector Windows that stems from the presence of improper access controls in the application. A local attacker could exploit the vulnerabilit...

CVE-2023-46601

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to...

CVE-2023-43505

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to...

CVE-2023-46601

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to...

CVE-2023-43505

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to...

CVE-2023-43505

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to...

PT-2023-7189 · Microsoft · Sapi +1

Name of the Vulnerable Software and Affected Versions: Microsoft Speech Application Programming Interface SAPI affected versions not specified Description: The issue is related to insufficient access restrictions in the Speech API SAPI of Windows operating systems. It allows an attacker to elevat...

PT-2023-6911 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insufficient access controls in the Windows Hyper-V hardware virtualization system, allowing an attacker to potentially elevate their privileges by sending...