137 matches found
Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration
Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...
Adobe Commerce/Magento - Customer Session Identity Switch
Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction. id: CVE-2026-71362 info: name: Adobe Commerce/Magento - Customer Session Identity Switch...
Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch
Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin...
CVE-2026-81997
Acrobat Reader is affected by an Incorrect Authorization vulnerability (CWE-863) that can result in a security feature bypass , allowing an attacker to gain unauthorized write access . Exploitation requires user interaction — a victim must open a malicious file — and the attack vector is local wi...
CVE-2026-81996 Acrobat Reader | Incorrect Authorization (CWE-863)
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed...
CVE-2026-77109
Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863) that allows a privilege escalation to restricted resources. The flaw is exploitable over the network with low complexity , requires no prior privileges and no user interaction , and has a changed scope , resulting in...
CVE-2026-77109 Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction. Scope is changed...
CVE-2026-77108
Adobe Commerce is affected by an Incorrect Authorization (CWE-863) vulnerability that can lead to privilege escalation , allowing a remote attacker with no user interaction to gain elevated access to sensitive information . The assigned CVSS v3.1 score is 7.5 (High) , reflecting a network-vectori...
CVE-2026-76202 Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...
CVE-2026-76202 Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...
CVE-2026-76202
Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863) that could allow an unauthenticated, remote attacker to escalate privileges and gain elevated access to sensitive information without user interaction. The CVSS v3.1 score is 8.2 (HIGH) , with primary impact to confi...
CVE-2022-0482_exploit
Explotación de la vulnerabilidad CVE-2022-0482 Introducción Este documento describe el análisis detallado de CVE-2022-0482, una vulnerabilidad crítica de seguridad identificada en el software de programación Easy!Appointments. Esta falla, relacionada con la Autorización Incorrecta según CWE-863,...
CVE-2026-54998-exp
DESCARGO DE RESPONSABILIDAD Este repositorio es solo para fines educativos y de investigación. El autor no es responsable por ningún uso indebido, daño o actividad ilegal causada por el uso de este material. Úselo bajo su propio riesgo. Respete las leyes aplicables y las pautas éticas. Resumen...
gitea-CVE-2026-28699
CVE-2026-28699: Omisión de alcance OAuth2 de Gitea a través de autenticación básica HTTP Un token de acceso OAuth2 de Gitea con alcance solo read:user puede realizar acciones de escritura completas cuando se envía como Authorization: Basic base64:x-oauth-basic en lugar de como un token Bearer. La...
CVE-2026-82302
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...
CVE-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...
CVE-2026-82298 Incorrect Authorization in Kibana Leading to Denial of Service
Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...
EUVD-2026-70661
Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...
PT-2026-85217
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...