SUSE CVE-2025-3611

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team...

WordPress plugin WC Pickup Store 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2025-45083

Incorrect access control in Ullu Android version v2.9.929 and IOS version v2.8.0 allows attackers to bypass parental pin feature via unspecified vectors...

CVE-2025-45083

Incorrect access control in Ullu Android version v2.9.929 and IOS version v2.8.0 allows attackers to bypass parental pin feature via unspecified vectors...

CVE-2025-45083

Incorrect access control in Ullu Android version v2.9.929 and IOS version v2.8.0 allows attackers to bypass parental pin feature via unspecified vectors...

CVE-2025-40910

Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally usi...

Volkswagen MIB3 Infotainment 安全漏洞

Volkswagen MIB3 Infotainment is an infotainment system on a vehicle from Volkswagen Germany. A security vulnerability exists in Volkswagen MIB3 Infotainment that stems from a lack of privilege separation in a proprietary inter-process communication mechanism, which could allow an attacker to bypa...

CVE-2025-40910

Net::IP::LPM (Perl) 1.10 is affected by a vulnerability where leading zero characters in IP CIDR strings are not properly handled, potentially allowing bypass of IP-based access controls. The CVE entry notes that leading zeros can indicate octal notation, creating ambiguity for users and enabling...

Net::IP::LPM 安全漏洞

Net::IP::LPM is a Perl module by Tomas Podermanski, a personal developer, that implements the Longest Prefix Matching LPM algorithm. A security vulnerability exists in Net::IP::LPM version 1.10 that stems from not properly handling IP address leading zeros, which could lead to an access control...

CVE-2025-49591 CryptPad 2FA Bypass Vulnerability

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication 2FA in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the...

CVE-2025-49591 CryptPad 2FA Bypass Vulnerability

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication 2FA in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the...

FreeBSD : Mozilla -- control access bypass (201cccc1-4a01-11f0-b0f8-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 201cccc1-4a01-11f0-b0f8-b42e991fc52e advisory. [email protected] reports: Thunderbird's update mechanism allowed a medium-integrity user process to...

CVE-2025-5982 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass via improper enforcement of access controls. An attacker can gain limited write access by bypassing security measures without requiring user...

CVE-2025-30957

Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through = 1.1.2...

CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

CVE-2025-20130

Cisco ISE/ISE-PIC expose an authenticated admin-facing Arbitrary File Upload vulnerability via the API due to improper validation of the file copy function. An admin with network access can send crafted file upload requests to a specific endpoint to upload arbitrary files. Cisco has released upda...

CVE-2025-20130 Cisco Identity Services Engine Access Control Bypass Vulnerability

A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy...

Exploit for HTTP Request Smuggling in Apache Http_Server

CVE 2023 25690 - Proof of Concept Published: 7 March 2023...

CVE-2024-7096

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: SOAP admin services are accessible to the attacker. The...