The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to execute arbitrary code and increase their privileges.

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and increase their privileges...

Vulnerability of the Server component: Security: Roles of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server component: Security: Roles of the Oracle MySQL Server database management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...

The vulnerability of the Jenkins Cisco Spark Notifier Plugin, related to deficiencies in access control, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Jenkins Cisco Spark Notifier Plugin is related to deficiencies in access control when processing HTTP endpoints. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to execute arbitrary code and increase their privileges.

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary code and increase their privileges...

GHSA-7HV6-GV38-78WJ DataEase API interface has IDOR vulnerability

Impact The api interface for DataEase delete dashboard and delete system messages is vulnerable to IDOR. The interface to delete the dashboard: 1. Create two users: user1 and user2 2. User1 creates a dashboard named pan1 3. User2 creates a dashboard named pan2 4. Both user1 and user2 share their...

Status PowerBPM 访问控制错误漏洞

Status PowerBPM is a BPM system from Status. An Access Control Error vulnerability exists in Status PowerBPM v2.0, which stems from insufficient authentication, and can be exploited by an attacker on a local area network with normal user privileges to modify an alternate agent to an arbitrary use...

CVE-2023-23562

Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters...

Stormshield Endpoint Security 安全漏洞

Stormshield Endpoint Security is a product line of enhanced workstation and server security from the French company Stormshield. A security vulnerability exists in Stormshield Endpoint Security versions 2.3.0 through 2.3.2 that stems from incorrect access control. An attacker could exploit the...

Stormshield Endpoint Security 安全漏洞

Stormshield Endpoint Security is a product line of enhanced workstation and server security from the French company Stormshield. A security vulnerability exists in Stormshield Endpoint Security versions 2.3.0 through 2.3.2, which stems from incorrect access control that allows an authenticated us...

WordPress plugin Download Manager 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent software for data protection, Acronis Cyber Protect 15, is related to deficiencies in access control. This vulnerability allows attackers to enhance their privileges.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent software for data protection, Acronis Cyber Protect 15, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-2255

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would lo...

IceCMS 安全漏洞

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . An access control error vulnerability exists in IceCMS v1.0.0, which stems from improper access control in the system and can be exploited by an attacker to cause sensitive information leakage...

NFine Rapid Development Platform 安全漏洞

NFine Rapid Development Platform is a C language based, very fast WEB + ORM framework for NFine individual developers. A security vulnerability exists in NFine Rapid Development Platform, which stems from systemManage/Organize/GetTreeGridJson?search=false&nd=1681813520783&rows=10000&page=1&...

Mitel MiVoice Connect 安全漏洞

Mitel MiVoice Connect is Mitel Canada's software for centralized management of Mitel Networks' call processing and collaboration tools. A security vulnerability exists in Mitel MiVoice Connect version 19.3 SP2 and prior versions that stems from improper access control and allows an unauthenticate...

Videogo 安全漏洞

ezviz Videogo is a cloud video application from Fluorite ezviz. A security vulnerability exists in Videogo v6.8.1, which stems from incorrect access control. An attacker can exploit the vulnerability to access a mirror from another device by modifying the Device Id parameter...

Videogo 安全漏洞

ezviz Videogo is a cloud video application from Fluorite ezviz. A security vulnerability exists in Videogo version v6.8.1, which stems from incorrect access control...

CVE-2023-28522 IBM API Connect improper access control

IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585...

CVE-2022-46307

SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality of arbitrary electronic locks...

PT-2023-21667 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command "/mute" occur after checking whether a user is a member of a given channel, leaking private...