VulnCheck KEV: CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

NewStart CGSL MAIN 6.06 : keepalived Vulnerability (NS-SA-2023-0097)

The remote NewStart CGSL host, running version MAIN 6.06, has keepalived packages installed that are affected by a vulnerability: - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This...

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to vulnerabilities in access control, allows attackers to bypass security restrictions.

The vulnerabilities of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to circumvent security restrictions by synchronizing publicly...

PT-2023-7704 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.0, 7.0.13 and below, 6.4.14 and below FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below Description: The issue is related to improper access control, which may allow a remote unauthenticated attacker ...

OroCRMCallBundle Access Control Error Vulnerability

OroCRMCallBundle is a plugin package from Oro. An Access Control Error vulnerability exists in OroCRMCallBundle, which stems from insufficient security checks and allows an attacker to bypass the security restrictions of an Access Control List ACL to access information in any event. Affected...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass when the Blazor server forms in ASP.NET Core applications are used. An attacker can bypass validation and trigger unintended actions by exploiting this vulnerability. This is only exploitable if the application is ...

win-joy.de Improper Access Control vulnerability OBB-3780399

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-20246

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic error that occurs when the access control policies are being...

PT-2023-7557 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to multiple vulnerabilities in the per-user-override...

Design/Logic Flaw

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

The vulnerability of the WireMock software for creating virtual HTTP services relates to bypassing authentication through spoofing, allowing attackers to circumvent established access controls.

The vulnerability of the WireMock software for creating virtual HTTP services relates to the bypassing of authentication mechanisms through spoofing techniques. Exploiting this vulnerability allows a malicious actor to circumvent established access controls...

PT-2023-30149 · Sielco · Sielco Polyeco1000

Name of the Vulnerable Software and Affected Versions: Sielco PolyEco1000 affected versions not specified Description: The issue arises from an improper access control vulnerability. This occurs when the application provides direct access to objects based on user-supplied input, allowing attacker...

CVE-2023-46319

WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface...

PT-2023-29957 · Wallix · Wallix Bastion

Name of the Vulnerable Software and Affected Versions: WALLIX Bastion versions 9.x through 9.0.8 WALLIX Bastion versions 10.x through 10.0.4 Description: The issue allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface...

WALLIX Bastion Security Vulnerability

WALLIX Bastion is a modular solution from WALLIX France. A security vulnerability exists in WALLIX Bastion versions 9.x prior to 9.0.9 and 10.x prior to 10.0.5, which stems from a vulnerability that allows access control to be bypassed, followed by unauthenticated access to sensitive information...

PT-2023-22684 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS versions prior to 23.06 dotCMS versions prior to LTS 22.03.7 dotCMS versions prior to LTS 23.01.4 Description: A flaw in the NormalizationFilter of dotCMS does not strip double slashes // from URLs, potentially enabling bypasses for XS...

The vulnerability of Google Chrome’s Autofill function allows attackers to bypass existing security restrictions.

The vulnerability of Google Chrome’s Autofill function is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions through a specially created HTML page...

The vulnerability of the Downloads component in the Google Chrome browser allows a hacker to bypass existing security restrictions.

The vulnerability of the Downloads component in the Google Chrome browser is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

Medium: squid

Issue Overview: A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protection and resulting in information disclosure. CVE-2022-41317 Affected Packages: squid Note: This advisory is applicable to Amazon Linux 2 - Squid4 Extra...

Low: redis

Issue Overview: A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the potentially higher privileges of another Redis user. CVE-2022-24735 A flaw was found in the Red...