CVE-2023-38048 A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38047

CVE-2023-38047 affects Easy!Appointments prior to 1.5.0. The issue is an authorization flaw in GET, PUT, and DELETE on /categories/{categoryId} that lets a low-privileged user fetch, modify, or delete category data for any user (including admins), causing unauthorized access and data manipulation...

CVE-2023-38047 A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0.

A BOLA vulnerability in GET, PUT, DELETE /categories/categoryId allows a low privileged user to fetch, modify or delete the category of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38047 A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0.

A BOLA vulnerability in GET, PUT, DELETE /categories/categoryId allows a low privileged user to fetch, modify or delete the category of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3290

Consolidated from connected records, CVE-2023-3290 applies to EasyAppointments, specifically the vulnerability in POST /customers. The root cause is an insecure authorization check that lets a low-privileged user create another low-privileged customer, enabling unauthorized data manipulation. Rel...

CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3287 A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user admin in the system. This results in privilege escalation...

CVE-2023-3287 A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user admin in the system. This results in privilege escalation...

CVE-2023-3287 A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user admin in the system. This results in privilege escalation...

CVE-2023-3285

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...