3272 matches found
CVE-2025-29524
Incorrect access control in the component /cgi-bin/systemdiagnosticmain.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information...
CVE-2025-29515
Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...
D-Link DSL-7740C 安全漏洞
The D-Link DSL-7740C is a modem from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DSL-7740C DSL7740C.V6.TR069.20211230 version, which stems from improper access control of the DELTfile.xgi endpoint, and can be exploited by an attacker to modify arbitrary...
CVE-2025-29520
CVE-2025-29520 affects D-Link DSL-7740C (firmware DSL7740C.V6.TR069.20211230). The root cause is an incorrect access-control in the Maintenance module, allowing authenticated attackers with low-level privileges to arbitrarily change high-privileged account passwords, enabling privilege escalation...
CVE-2025-29514
CVE-2025-29514 affects D-Link DSL-7740C (firmware DSL7740C.V6.TR069.20211230). The issue is an incorrect access control in the config.xgi function that could allow an attacker to download the device configuration by sending a crafted web request. CVSS v3.1 vector indicates Network access, Low att...
CVE-2025-29524
Incorrect access control in the component /cgi-bin/systemdiagnosticmain.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information...
CVE-2025-44178
DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information and modify its configuration via the UPnP protocol WAN sides without any authentication...
CVE-2025-29515
CVE-2025-29515 affects D-Link DSL-7740C: the DELT_file.xgi endpoint has improper access control, enabling an attacker to modify arbitrary settings in the device’s XML database, including the administrator password. Affected component is the DELT_file.xgi API, within firmware DSL7740C.V6.TR069.202...
CVE-2024-46412
Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location...
CVE-2025-29515
Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...
CVE-2024-53494
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication...
CVE-2024-53496
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...
CVE-2025-55366
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...
CVE-2025-55368
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account...
CVE-2024-53494
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication...
CVE-2024-57154
Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index...
CVE-2025-55634
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allows unauthorized attackers to cause a Denial of Service DoS via initiating a large number of simultaneous ffmpeg-based stream pushes...
CVE-2024-53494
CVE-2024-53494 affects SpringBootBlog v1.0.0. The root cause is an incorrect access control in the preHandle function, enabling attackers to access sensitive components without authentication. CVSS v3.1 base score 7.5 ( HIGH ); attack vector NETWORK, no privileges required, no user interaction. E...
PT-2025-34447 · Unknown · Springboot-Blog
Name of the Vulnerable Software and Affected Versions: SpringBootBlog version 1.0.0 Description: An incorrect access control issue exists in the preHandle function of SpringBootBlog version 1.0.0. This allows attackers to access sensitive components without proper authentication. Recommendations:...