CVE-2024-25120

CVE-2024-25120 affects TYPO3 and concerns improper access control of resources referenced by the t3:// URI scheme. The vulnerability could allow a backend authenticated user to access resources outside the user’s permission scope (files, folders, pages, records) via t3:// link handling. Affected ...

SUSE SLED12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2024:0437-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0437-1 advisory. - CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character bsc1210638. Tenable has...

GHSA-52XQ-J7V9-V4V2 Vyper negative array index bounds checks

Summary Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an int as an index for an array. Typically, negative integers are filtered out at runtime by the bounds checker, but small enough i.e. large...

CVE-2024-0844

The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute...

TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass Vulnerability

TELSAT marKoni FM Transmitter version 1.9.5 implements client-side restrictions that can be bypassed by editing the HTML source page that enable administrative operations. TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass Vendor: TELSAT Srl Product web page:...

CVE-2024-0415

A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file application/home/controller/TaobaoExport.php of the component Image URL Handler. The manipulation leads to improper access controls. The attack ca...

VulnCheck KEV: CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

NewStart CGSL MAIN 6.06 : keepalived Vulnerability (NS-SA-2023-0097)

The remote NewStart CGSL host, running version MAIN 6.06, has keepalived packages installed that are affected by a vulnerability: - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This...

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to vulnerabilities in access control, allows attackers to bypass security restrictions.

The vulnerabilities of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to circumvent security restrictions by synchronizing publicly...

PT-2023-7704 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.0, 7.0.13 and below, 6.4.14 and below FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below Description: The issue is related to improper access control, which may allow a remote unauthenticated attacker ...

OroCRMCallBundle Access Control Error Vulnerability

OroCRMCallBundle is a plugin package from Oro. An Access Control Error vulnerability exists in OroCRMCallBundle, which stems from insufficient security checks and allows an attacker to bypass the security restrictions of an Access Control List ACL to access information in any event. Affected...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass when the Blazor server forms in ASP.NET Core applications are used. An attacker can bypass validation and trigger unintended actions by exploiting this vulnerability. This is only exploitable if the application is ...

win-joy.de Improper Access Control vulnerability OBB-3780399

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-20246

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic error that occurs when the access control policies are being...

PT-2023-7557 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to multiple vulnerabilities in the per-user-override...

Design/Logic Flaw

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

The vulnerability of the WireMock software for creating virtual HTTP services relates to bypassing authentication through spoofing, allowing attackers to circumvent established access controls.

The vulnerability of the WireMock software for creating virtual HTTP services relates to the bypassing of authentication mechanisms through spoofing techniques. Exploiting this vulnerability allows a malicious actor to circumvent established access controls...

PT-2023-30149 · Sielco · Sielco Polyeco1000

Name of the Vulnerable Software and Affected Versions: Sielco PolyEco1000 affected versions not specified Description: The issue arises from an improper access control vulnerability. This occurs when the application provides direct access to objects based on user-supplied input, allowing attacker...

CVE-2023-46319

WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface...

PT-2023-29957 · Wallix · Wallix Bastion

Name of the Vulnerable Software and Affected Versions: WALLIX Bastion versions 9.x through 9.0.8 WALLIX Bastion versions 10.x through 10.0.4 Description: The issue allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface...