Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Magento versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privile...

CVE-2023-41939

Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted typically optional permissions, like Overall/Manage to access functionality they're no longer entitled to...

CVE-2023-4587

An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server...

The vulnerability of the module module.constructor.createRequire() in the Node.js software platform allows a hacker to circumvent established security restrictions.

The vulnerability of the module module.constructor.createRequire in the Node.js software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to circumvent established security restrictions remotely...

Saho ADM100和ADM-100FP 访问控制错误漏洞

Saho ADM100 and Saho ADM-100FP are both full-featured security appliances from China's Saho Corporation. An access control error vulnerability exists in the Saho ADM100 and ADM-100FP, which stems from the lack of authentication for critical functions, and can be exploited by remote attackers to...

Cisco Application Policy Infrastructure Controller 安全漏洞

Cisco Application Policy Infrastructure Controller APIC is an automated infrastructure deployment and governance solution from Cisco. The Cisco Application Policy Infrastructure Controller suffers from an access control error vulnerability that stems from improper access control when using a...

The vulnerability of the Google Chrome browser’s Extensions API allows a hacker to bypass existing security restrictions.

The vulnerability of the Google Chrome browser’s Extensions API is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

Moodle 安全漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle, which stems from an insufficient check that allows access to other users' message data...

CVE-2023-25647

There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event...

The vulnerability of the Bluetooth A2DP driver for the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Bluetooth A2DP driver for the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Mitel MiVoice Connect Security Breach

Mitel MiVoice Connect is Mitel Canada's software for centralized management of Mitel Networks' call processing and collaboration tools. A security vulnerability exists in Mitel MiVoice Connect version 19.3 SP2 22.24.1500.0 that originates from improper access control within the Linux DVS server...

CVE-2023-39406

Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps to forcibly restart...

CVE-2023-39387

Vulnerability of permission control in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows...

CVE-2023-25757

Improper access control in some IntelR UnisonTM software before version 10.12 may allow a privileged user to potentially enable escalation of privilege via network access...

Intel PROSet/Wireless WiFi Software Security Vulnerability

Intel PROSet/Wireless WiFi Software is a wireless network card driver from Intel Corporation USA. A security vulnerability exists in Intel PROSet/Wireless WiFi and KillerTM WiFi that stems from improper access control. An attacker can exploit the vulnerability to elevate privileges...

The vulnerability of Microsoft Windows Defender operating system, which allows a hacker to increase their privileges

The vulnerability of Microsoft Windows Defender operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from Samsung South Korea. A security vulnerability exists in SAMSUNG Mobile devices SMR Aug-2023 Release 1 version, which stems from an incorrect access control vulnerability in TelephonyUI that...

The vulnerability of Google Chrome’s Sandbox component allows a violator to gain unauthorized access to protected information, compromise its integrity, or cause service failures.

The vulnerability of Google Chrome’s Sandbox component is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information, compromise its integrity, or cause service failures...

CVE-2023-38958

An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request...

ZKTeco BioAccess IVS 安全漏洞

ZKTeco BioAccess IVS is a lite web-based security platform from ZKTeco, China. An Access Control Error vulnerability exists in ZKTeco BioAccess IVS v3.3.1, which arises from improper access control and can be exploited by an attacker to arbitrarily close and open the door to the platform...