PT-2023-2989 · Cisco +1 · Cisco Spark +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cisco Spark Notifier Plugin versions 1.1.1 and earlier Description: The issue is related to a missing permission check in the Jenkins Cisco Spark Notifier Plugin, which allows attackers with Overall/Read permission to enumerate...

PT-2023-13988 · Tp Link · Tp-Link Tapo C200

Name of the Vulnerable Software and Affected Versions: TP-Link Tapo C200 version V1 Description: An access control issue allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value. Recommendations: F...

TP-LINK Tapo C200 安全漏洞

The TP-LINK Tapo C200 is a webcam device from China P&L TP-LINK. A security vulnerability exists in TP-LINK Tapo C200 version V1, which stems from an access control issue that allows a physically proximate attacker to gain root access by connecting to the UART pin, interrupting the boot process,...

The vulnerability of the command-line interface (CLI) of the microprogramming software for Cisco TelePresence Collaboration Endpoint conference call control devices and the Cisco RoomOS operating system allows a hacker to re-write any files at will.

The vulnerability of the command-line interface CLI of the microprogramming software for Cisco TelePresence Collaboration Endpoint conference call controllers and the Cisco RoomOS operating system is related to access control deficiencies. Exploiting this vulnerability could allow a attacker to...

The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.

The vulnerability of the Windows operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

ONLYOFFICE 授权问题漏洞

Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in all versions of ONLYOFFICE prior to 2021-11-08 that stems from being affected by incorrect access control. An attacker can use the default JWT signature key to authenticate to the Web...

MISP 安全漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.167 that stems from incorrect access...

The vulnerability of the Bind Filter driver for Windows operating systems allows attackers to bypass security restrictions and gain increased privileges.

The vulnerability of the Bind Filter driver for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to bypass security restrictions and enhance their privileges...

The vulnerability of FortiWLC wireless access controller software, related to deficiencies in access control, allows attackers to execute arbitrary commands and increase their privileges.

The vulnerability of the microprogrammed software of FortiWLC wireless access controllers is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely and elevate their privileges to the root level, bypassing the...

The vulnerability of the print spooler daemon on Microsoft Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Windows Print Spooler in Microsoft Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2022-2155

A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a...

CVE-2022-2155 A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.

A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a...

PT-2023-12668 · Hitachi · Lumada Apm

Name of the Vulnerable Software and Affected Versions: Lumada APM on-premises versions 6.0.0.0 through 6.4.0. Description: A vulnerability exists in Lumada APM's User Asset Group feature due to a flaw in access control mechanism implementation on the "Limited Engineer" role, granting it access to...

Hitachi Energy Lumada APM 安全漏洞

Hitachi Energy Lumada APM is an asset performance management software from Hitachi, Ltd Hitachi, Japan. provides predictive and forecasting insights to help reduce the risk of asset failure and minimize unplanned downtime. Hitachi Energy Lumada APM suffers from a security vulnerability that stems...

CVE-2022-4705

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprfinalsettingssetup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset...

CVE-2022-4704

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprimporttemplateskit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site...

CVE-2022-4702

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprfixroyalcompatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on...

CVE-2022-4701

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpractivaterequiredplugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the...

CVE-2023-0017

An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current...

PT-2023-15131 · WordPress · Media Library Assistant +3

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.3.59 Description: The issue is related to insufficient access control in the 'wpr activate required plugins' AJAX action. This allows any authenticated user,...