3414 matches found
D-Link DSL-7740C 安全漏洞
The D-Link DSL-7740C is a modem from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DSL-7740C DSL7740C.V6.TR069.20211230 version, which stems from improper access control of the DELTfile.xgi endpoint, and can be exploited by an attacker to modify arbitrary...
CVE-2024-53494
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication...
CVE-2024-53496
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...
CVE-2025-55368
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account...
CVE-2025-55366
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...
CVE-2024-53494
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication...
CVE-2024-57154
Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index...
PT-2025-34447 · Unknown · Springboot-Blog
Name of the Vulnerable Software and Affected Versions: SpringBootBlog version 1.0.0 Description: An incorrect access control issue exists in the preHandle function of SpringBootBlog version 1.0.0. This allows attackers to access sensitive components without proper authentication. Recommendations:...
CVE-2024-53496
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...
CVE-2024-53494
The SpringBootBlog software (also referred to as Kyrie Blog ) version 1.0.0 is vulnerable to an improper access control issue within the preHandle function. This flaw allows an attacker to bypass authentication and gain unauthorized access to sensitive components . To remediate this, users should...
CVE-2025-55634
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allows unauthorized attackers to cause a Denial of Service DoS via initiating a large number of simultaneous ffmpeg-based stream pushes...
PT-2025-34462
Name of the Vulnerable Software and Affected Versions: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.4662 2503122283 Description: An incorrect access control issue exists in the RTMP server settings. This allows attackers to cause a Denial of Service DoS by initiating a...
Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect Rational Business Developer
Summary There are multiple vulnerabilities in IBM Semeru Runtime used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVEs. These issues were disclosed as part of the IBM Semeru Runtime Quarterly CPU - Apr 2025 - Includes OpenJDK April 2025 CPU pl...
CVE-2025-55367
Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account...
CVE-2025-55366
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...
CVE-2025-49810 Thread summarization allows persistent access to channel
Mattermost versions 10.5.x = 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts...
CVE-2025-51529
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server resource exhaustion via unlimited database write operations to the...
CVE-2025-9264
A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource...