CVE-2024-46610

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java...

ROS-20240924-01

The vulnerability in Firefox and Firefox ESR browsers and Thunderbird email client is related to flaws in the in access control. Exploitation of the vulnerability could allow an attacker acting remotely, redirect a user to an arbitrary URL using a specially crafted extension The vulnerability in...

VulnCheck KEV: CVE-2021-32172

Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...

The vulnerability in the user interfaces of Google Chrome and Microsoft Edge browsers allows attackers to disclose protected information.

The vulnerability of Google Chrome and Microsoft Edge browser user interfaces is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially crafted HTML page...

The vulnerability of the LiteSpeed Cache plugin for WordPress (LSCWP), a content management system for WordPress websites, allows a hacker to gain unauthorized access to the debug log file “/wp-content/debug.log”.

The vulnerability of the LiteSpeed Cache plugin for WordPress LSCWP, a content management system for WordPress websites, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the debug log file...

PT-2024-6469

Name of the Vulnerable Software and Affected Versions VMware vCenter Server affected versions not specified Description The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges t...

Relyum RELY-PCIe 安全漏洞

Relyum RELY-PCIe is a smart pluggable board from Relyum Spain. A security vulnerability exists in Relyum RELY-PCIe versions v22.2.1 through v23.1.0, which stems from incorrect access control contained in the mService function of phpinf.php...

Huawei HarmonyOS and EMUI Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scene distributed operating system based on a microkernel.Huawei EMUI is an emotional operating system developed by Huawei based on Android Android. A privilege control vulnerability exists in Huawei...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to deficiencies in access control. These flaws allow attackers to bypass security restrictions and compromise the confidentiality and integrity of protected information.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and affect the confidentiality and integrity of protected information by creatin...

PT-2024-31239 · Unknown · Shenzhou News Union Enterprise Management System

Name of the Vulnerable Software and Affected Versions: Shenzhou News Union Enterprise Management System versions 5.0 through 18.8 Description: The issue is related to incorrect access control in the component /servlet/SnoopServlet, allowing attackers to access sensitive information regarding the...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...

Rockwell Automation ThinManager ThinServer Arbitrary File Creation Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Rockwell Automation ThinManager. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Joomla! 安全漏洞

Joomla! is a free, open source content management system from Joomla! open source. A security vulnerability exists in Joomla! versions 4.0.0 through 4.4.6 and 5.0.0 through 5.1.2, which stems from the presence of improper access control that allows a back-end user to override his or her username...

CVE-2024-43250

Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...

WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin UsersWP versions = 1.2.15...

The vulnerability of the Junos OS Evolved operating system, related to deficiencies in access control, allows a perpetrator to resume an earlier session and gain access to the user account.

The vulnerability of the Junos OS Evolved operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to resume a previous session and gain access to the user account...

PT-2024-30227 · Totolink · Totolink N350Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version V9.3.5u.6139 B20201216 Description: The issue is related to incorrect access control, allowing attackers to obtain the apmib configuration file, which contains the username and password, via a crafted request to...

CVE-2024-28050

Improper access control in some IntelR ArcTM & IrisR Xe Graphics software before version 31.0.101.4824 may allow an authenticated user to potentially enable denial of service via local access...

PT-2024-5740 · Microsoft · Windows 10 +1

Name of the Vulnerable Software and Affected Versions: Windows 10 affected versions not specified Description: The issue is related to a lack of access control in the Windows Update Stack component, which can be exploited to elevate privileges. An attacker must first obtain the ability to execute...