37 matches found
CVE-2026-53638 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an...
CVE-2026-53638
Sylius (open-source eCommerce framework built on Symfony) is affected by an authorization bypass in the shop account API. The endpoint PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}—used by an authenticated customer to change the payment method of an unpaid order—fails to val...
CVE-2026-53638 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an...
CVE-2026-62836
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Impact An authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid state STATENEW, does not...
CVE-2025-36438
IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints...
CVE-2025-36438
IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints...
CVE-2025-36438 Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints...
EUVD-2025-208895
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the...
CVE-2025-62843 QuRouter
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the...
CVE-2025-62843
CVE-2025-62843 affects QHora/QuRouter where an improper restriction of a communication channel to intended endpoints allows a user with physical access to gain privileges intended for the original endpoint. The issue is fixed in QuRouter 2.6.3.009 and later. The CVSS-like metrics indicate physica...
PT-2026-26633
Name of the Vulnerable Software and Affected Versions QHora versions prior to 2.6.3.009 Description An issue exists in QHora where an improper restriction of communication channels to intended endpoints can allow an attacker with physical access to gain elevated privileges. The issue was exploite...
CVE-2026-23664
Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network...
CVE-2025-58742
Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle AiTM by modifying the 'Server' field to redirect client...
CVE-2025-33176
NVIDIA RunAI for all platforms is affected by a vulnerability allowing improper restriction of adjacent network communication channels. The issue could enable privilege escalation, data tampering, and information disclosure. Public-enriched sources (NVIDIA security bulletin and Red Hat advisory) ...
PT-2025-45038
Name of the Vulnerable Software and Affected Versions NVIDIA RunAI affected versions not specified Description The software contains a flaw that could allow a user to improperly restrict communications channels on a neighboring network. Exploitation of this issue may result in privilege escalatio...
EUVD-2025-27373
Malicious code in bioql PyPI...
PowerShell Direct Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally...