CVE-2024-31964

CVE-2024-31964 CVE-2024-31964 概念验证: Mitel 6900w 系列 SIP 电话 - 临时身份认证绕过 漏洞详情 总结 该漏洞涉及多个 Mitel 产品 HTTP 管理网站面板中的临时身份认证绕过漏洞。 影响 允许攻击者修改设备配置，并对受影响设备执行拒绝服务攻击。 利用条件 攻击者需要与被利用用户来自同一源 IP，且该用户在几分钟前已成功登录。 建议的 CVSS 建议的 CVSS: CVSS v4.0 评分: 7.2 CVSS v4.0 向量:...

CVE-2024-11680

Exploit para CVE-2024-11680 de ProjectSend Este es un exploit de prueba de concepto para CVE-2024-11680, una vulnerabilidad de modificación de configuración no autenticada y carga de web shell en ProjectSend. Descripción El exploit aprovecha múltiples vulnerabilidades en ProjectSend: Bypass del...

CVE-2021-40113

CVE-2021-40113 Cisco Catalyst 无源光网络 PON 系列交换机光网络终端 ONT 的基于 Web 的管理界面中存在多个漏洞，可能允许未经身份验证的远程攻击者执行以下操作：如果 Telnet 协议已启用，则使用默认凭据登录；执行命令注入；修改配置。有关这些漏洞的更多信息，请参阅本公告的详细信息部分。 身份验证| 复杂度| 向量 ---|---|--- 无| 低| 网络 机密性| 完整性| 可用性 ---|---|--- 部分| 部分| 部分 CVSS 评分：7.5 参考...

CVE-2020-11107

CVE-2020-11107 这是我所发现的 CVE-2020-11107 的分析报告。 在 Windows 上，XAMPP 早于 7.2.29、7.3.x 早于 7.3.16 以及 7.4.x 早于 7.4.4 的版本中发现了一个问题。 非特权用户可以更改 xampp-contol.ini 中的 .exe 配置，从而影响所有用户（包括管理员），实现任意命令执行。 所有这一切都可以通过 xampps 控制面板完成。 XAMPP 允许非特权用户访问和修改其编辑器和浏览器配置。默认值为 notepad.exe 默认值可以被更改，以便将某个 bat...

CVE-2021-42562

CVE-2021-42562: MITRE Caldera 中的不当访问控制 Caldera（版本 = 2.8.1）未能正确隔离用户权限，导致非管理员用户能够访问、读取和修改本应仅供管理员访问的配置或其他组件。 供应商披露： 此漏洞的供应商披露可在此处找到。 要求： 此漏洞需要： 有效的非管理员用户凭据 概念验证： 更多详细信息和利用过程可在此 PDF 中找到。 其他资源： 此漏洞允许非管理员用户在 MITRE Caldera 中利用漏洞 CVE-2021-42559：在 MITRE Caldera 中通过配置进行命令注入 以实现远程代码执行。...

CVE-2026-85981

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

CVE-2026-85983 Local Privilege Escalation in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...

CVE-2026-85981

The Auth0 AD/LDAP Connector (versions 6.5.0 and earlier ) has an unauthenticated administrative panel that listens on the local loopback interface without requiring credentials. A local, low-privileged user or process on the host can access the panel's management endpoints to read configuration d...

CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

BIT-JENKINS-2026-84653

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

Summary An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. Impact An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modif...

CVE-2026-82302

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

EUVD-2026-70663

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)

Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: Fixes should be...

PT-2026-85217

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-77125

Sonatype Nexus Repository 3 contains an incorrect authorization flaw in two blobstore group management REST API endpoints . A user holding only the nexus:blobstores:create permission (which must be explicitly granted and is not default) could invoke these endpoints to convert an existing blobstor...

EUVD-2026-68613

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-77966

CVE-2026-77966 affects the Ebyte NA111-M , a CISA ICS-listed product, where missing authorization fails to separate limited and administrative management functions. A low-privileged authenticated attacker can access security-sensitive configuration functions and modify settings that impact the de...

CVE-2026-77966 Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...