The vulnerability of the QTS operating system and QNAP network devices, related to access control deficiencies, allows a hacker to execute arbitrary code within the system.

The vulnerability of the QTS operating system and QNAP network devices is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the system remotely...

CVE-2024-46097

TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...

CVE-2024-46610

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java...

Multiple NTT EAST Home GateWay/Hikari Denwa routers fail to restrict access permissions

Overview Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION fail to restrict access permissions CWE-451. Keishi Awata of logicalmixed reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

CVE-2024-46610

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java...

The vulnerability of Google Chrome’s Compositing component allows attackers to manipulate the user’s security interface without being detected.

The vulnerability of Google Chrome’s Compositing component is related to improper access control. Exploiting this vulnerability could allow attackers to forge the user’s security interface using a specially created HTML page...

ROS-20240924-01

The vulnerability in Firefox and Firefox ESR browsers and Thunderbird email client is related to flaws in the in access control. Exploitation of the vulnerability could allow an attacker acting remotely, redirect a user to an arbitrary URL using a specially crafted extension The vulnerability in...

VulnCheck KEV: CVE-2021-32172

Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...

The vulnerability in the user interfaces of Google Chrome and Microsoft Edge browsers allows attackers to disclose protected information.

The vulnerability of Google Chrome and Microsoft Edge browser user interfaces is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially crafted HTML page...

The vulnerability of the LiteSpeed Cache plugin for WordPress (LSCWP), a content management system for WordPress websites, allows a hacker to gain unauthorized access to the debug log file “/wp-content/debug.log”.

The vulnerability of the LiteSpeed Cache plugin for WordPress LSCWP, a content management system for WordPress websites, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the debug log file...

PT-2024-6469

Name of the Vulnerable Software and Affected Versions VMware vCenter Server affected versions not specified Description The vCenter Server contains a privilege escalation issue. An attacker with network access to the vCenter Server can exploit this to gain root-level privileges by sending a...

Relyum RELY-PCIe 安全漏洞

Relyum RELY-PCIe is a smart pluggable board from Relyum Spain. A security vulnerability exists in Relyum RELY-PCIe versions v22.2.1 through v23.1.0, which stems from incorrect access control contained in the mService function of phpinf.php...

Huawei HarmonyOS and EMUI Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scene distributed operating system based on a microkernel.Huawei EMUI is an emotional operating system developed by Huawei based on Android Android. A privilege control vulnerability exists in Huawei...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to deficiencies in access control. These flaws allow attackers to bypass security restrictions and compromise the confidentiality and integrity of protected information.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and affect the confidentiality and integrity of protected information by creatin...

PT-2024-31239 · Unknown · Shenzhou News Union Enterprise Management System

Name of the Vulnerable Software and Affected Versions: Shenzhou News Union Enterprise Management System versions 5.0 through 18.8 Description: The issue is related to incorrect access control in the component /servlet/SnoopServlet, allowing attackers to access sensitive information regarding the...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...

Rockwell Automation ThinManager ThinServer Arbitrary File Creation Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Rockwell Automation ThinManager. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Joomla! 安全漏洞

Joomla! is a free, open source content management system from Joomla! open source. A security vulnerability exists in Joomla! versions 4.0.0 through 4.4.6 and 5.0.0 through 5.1.2, which stems from the presence of improper access control that allows a back-end user to override his or her username...

CVE-2024-43250

Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...