CVE-2023-38050

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38051

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38054

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38047

A BOLA vulnerability in GET, PUT, DELETE /categories/categoryId allows a low privileged user to fetch, modify or delete the category of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38048

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38049

A BOLA vulnerability in GET, PUT, DELETE /appointments/appointmentId allows a low privileged user to fetch, modify or delete an appointment of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3288 A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-3288 A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-3288 A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-38055

The CVE CVE-2023-38055 affects Easy!Appointments (vulnerable in versions before 1.5.0) via the GET, PUT, and DELETE /services/{serviceId} endpoint. The root cause is an insufficient access-control check in this interface, enabling a low-privileged user to fetch, modify, or delete services for any...

CVE-2023-38055 A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38055 A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38055 A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38054 A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38054 A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38054

CVE-2023-38054 affects Easy!Appointments; a BOLA flaw in GET/PUT/DELETE /customers/{customerId} lets a low-privilege user fetch/modify/delete other low-privilege customers. Root cause: insufficient access checks. Impact: unauthorized data access and manipulation. Affected: Easy!Appointments versi...

CVE-2023-38054 A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38053 A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /settings/settingName allows a low privileged user to fetch, modify or delete the settings of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38053 A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /settings/settingName allows a low privileged user to fetch, modify or delete the settings of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38053

CVE-2023-38053 describes a BOLA vulnerability in EasyAppointments (GET, PUT, DELETE /settings/{settingName}) where a low-privileged user can fetch, modify, or delete the settings of any user (including admins) due to insufficient access control. Impact documented as unauthorized access and unauth...