1141 matches found
CVE-2020-11107
CVE-2020-11107 This is a writeup for CVE-2020-11107 I've found. An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users including admins to enable arbitrary...
CVE-2026-116672
A flaw was found in Authlib. An authenticated remote attacker can bypass authorization controls to access, modify, or delete configurations belonging to other clients. In deployments implementing the documented reference code for dynamic client configuration, the server validates client editabili...
CVE-2024-31964
CVE-2024-31964 CVE-2024-31964 PoC: Mitel 6900w Series SIP Phone - Temporary Authentication Bypass Vulnerability details Summary It consists of a temporary authentication bypass vulnerability in the HTTP administrative website panel of several Mitel Products. Impact Allows an attacker to modify th...
Dji_ble_vuln
CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...
CVE-2021-42562
CVE-2021-42562: Improper Access Control in MITRE Caldera Caldera versions =2.8.1 does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components which should only be accessible by admin users. Vendor Disclosure: The...
CVE-2021-40113
CVE-2021-40113 Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network PON Series Switches Optical Network Terminal ONT could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the...
CVE-2026-77053
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...
EUVD-2026-109948
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...
PT-2026-123358
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
Linux Distros Unpatched Vulnerability : CVE-2026-15577
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource...
BIT-GRAFANA-2026-15577 Git Sync connection configuration can be modified with read-only access
A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
CVE-2026-111046 FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...
CVE-2026-111046 FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...
CVE-2026-111046 FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...
CVE-2026-111046
In FOSSBilling versions 0.8.4 through 0.8.6 , a broken access control vulnerability allows low-privileged staff accounts to interact with deactivated non-core modules . The root cause is that the hasManagePermission function fails open because an early return for inactive modules skips critical m...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
SUSE CVE-2026-15577
A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...
CVE-2026-15577 Git Sync connection configuration can be modified with read-only access
A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource incorrect authorization. On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled...