The batchRefund function could benefit from access control checks, such as ensuring only authorized users can perform batch refunds.

Lines of code Vulnerability details M1 - The batchRefund function could benefit from access control checks, such as ensuring only authorized users can perform batch refunds. poc: solidity function batchRefund external onlyAuthorized returns Assessed type Access Control --- The text was updated...

Information Disclosure

org.wildfly.core: wildfly-controller is vulnerable to Information Disclosure. The vulnerability is caused by a missing authorization check in the resolve-expression HAL interface while reading a system property or environment variables. This can lead to a malicious user accessing the Wildfly syst...

CVE-2023-3998

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post...

Authorization

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a comment...

Authorization

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post...

wpDiscuz < 7.6.4 - Post Rating Increase/Decrease iva IDOR

Description The plugin is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function...

PT-2023-27189 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: wpDiscuz plugin for WordPress versions up to, and including, 7.6.3 Description: The issue is related to a missing authorization check on the userRate function, allowing unauthenticated attackers to modify data by increasing or decreasing the...

CVE-2023-42473 Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)

S/4HANA Manage Withholding Tax Items - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application...

Missing Authorization

Apache Superset is vulnerable to Improper Authorization in the SQLLab component. The vulnerability is due to an incorrect authorization check in Apache Superset which allows an attacker to query tables that they do not have proper access to within Superset...

CVE-2023-40309 Missing Authorization check in SAP CommonCryptoLib

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-40309 Missing Authorization check in SAP CommonCryptoLib

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-40625 Missing Authorization check in SAP Manage Purchase Contracts App

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-40625 Missing Authorization check in SAP Manage Purchase Contracts App

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-32672

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability...

CVE-2023-32672

The CVE-2023-32672 entry concerns an incorrect authorization check in SQLLab of Apache Superset up to version 2.1.0. The vulnerability allows an authenticated user to query tables they should not access due to a SQL parsing vulnerability. The affected component is Apache Superset’s SQLLab feature...

CVE-2023-32672 Apache Superset: SQL parser edge case bypasses data access authorization

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability...

CVE-2023-32678 Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that the...

WordPress InfiniteWP Client Plugin < 1.9.4.5 Authentication Bypass Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:revmakx:infinitewpclient"; ifdescription...

CVE-2023-39438

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...