The vulnerability of Windows operating system task schedulers allows a malicious actor to execute arbitrary commands with SYSTEM privileges.

The vulnerability of Windows operating system task schedulers is related to access control errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with SYSTEM privileges by sending a specially crafted XML file...

CVE-2025-28059

An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke...

CVE-2025-32795

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite...

CVE-2025-32796

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes...

CVE-2025-32796 Dify Allows Unauthorized APP Enable/Disable via API

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes...

CVE-2025-32796

Dify (open‑source LLM app platform) prior to version 0.6.12 is affected by an access control flaw where normal users can enable/disable apps via the API despite UI restrictions. The root cause is an insufficiently enforced permissions model, allowing non‑admin changes that can disrupt app functio...

CVE-2025-32795 Dify Allows Insecure User Role Access Control for APP Editing

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite...

CVE-2025-32795

CVE-2025-32795 affects Dify, an open-source LLM app development platform. Prior to version 0.6.12, a misconfigured access control allowed normal/non-admin users to edit app details (names, descriptions, icons) despite not having permission to view apps, compromising integrity. Root cause: insuffi...

CVE-2025-32795 Dify Allows Insecure User Role Access Control for APP Editing

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite...

CVE-2025-28230

Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials...

PT-2025-17317 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A security issue was identified in Dify, an open-source LLM app development platform, where normal users are improperly granted permissions to edit app names, descriptions, and icons. This access...

PT-2025-17318 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A vulnerability was identified in Dify, an open-source LLM app development platform, where normal users can enable or disable apps through the API, despite not being permitted to make such changes...

Erlang/OTP 访问控制错误漏洞

Erlang/OTP is an Erlang/OTP open source library written in JavaScript that handles handling exceptions. The library catches exceptions raised by the node.js built-in API. An access control error vulnerability exists in Erlang/OTP versions prior to 27.3.3, which stems from an SSH protocol message...

The software client’s vulnerability for providing remote access with SonicWall NetExtender allows a intruder to delete any files they want.

The vulnerability of the software client for remote access support provided by SonicWall NetExtender is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to delete any files they desire...

CVE-2025-32221

Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through = 2.7.1...

The vulnerability in the web interface for managing Tenda FH1202 micro-program software routers allows a hacker to escalate their privileges.

The vulnerability of the web interface for managing Tenda FH1202 micro-programming software routers is related to deficiencies in access control when processing the /goform/VirSerDMZ endpoint. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending a speciall...

CVE-2025-24866

CVE-2025-24866 affects Mattermost server (Mattermost 9.11.x, including 9.11.8 and earlier) where the access control on the /api/v4/audits endpoint is improper. The vulnerability allows users with delegated granular administration roles who do not have access to Compliance Monitoring to retrieve U...

The vulnerability in the web interface for managing Tenda FH1202 micro-program software routers allows a hacker to escalate their privileges.

The vulnerability of the web interface for managing Tenda FH1202 micro-programming software routers is related to deficiencies in access control when processing the /goform/qossetting endpoint. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially...

The vulnerability in the web interface for managing Tenda FH1202 micro-program software routers allows a hacker to escalate their privileges.

The vulnerability of the web interface for managing Tenda FH1202 micro-programming software routers is related to deficiencies in access control when processing the /goform/SysToolChangePwd endpoint. Exploiting this vulnerability can allow a malicious actor to enhance their privileges by sending...

VBlog 安全漏洞

VBlog is a multi-user blog management platform for lenve individual developers. A security vulnerability exists in VBlog 1.0.0 and earlier versions, which stems from improper access control in WebSecurityConfig.java, which could lead to elevated privileges...