CVE-2023-22813 Device API endpoint missing access controls on Western Digital Mobile and Web Apps

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS...

IBM Cognos Analytics 代码问题漏洞

IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. An Access Control...

CVE-2023-21490

Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager...

CVE-2023-21488

Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips...

The vulnerability of the Universal Print Server software for virtualizing and delivering Citrix Virtual Apps and Desktops (formerly XenApp and XenDesktop) on Windows operating systems allows a malicious individual to escalate their privileges and execute arbitrary commands.

The vulnerability of the Universal Print Server software, which is used for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop applications to Windows operating systems, is related to deficiencies in access control. Exploiting this vulnerability allows an...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.3.x. The vulnerability stems from vulnerability to faulty access control, where an authenticated attacker with agent and client roles can make unauthorized changes t...

PT-2023-22455 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 5.3.x through 5.3.x Description: The issue allows an authenticated attacker to gain information about linked accounts of users involved in their tickets using the Zammad API. This is due to Incorrect Access Control...

CVE-2023-26735

blackboxexporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured...

UBUNTU-CVE-2023-26735

DISPUTED blackboxexporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured...

Linux Prometheus Blackbox Exporter 代码问题漏洞

Linux Prometheus Blackbox Exporter is a blackbox exporter from the Linux Foundation in the United States that allows blackbox probing of endpoints over HTTP, HTTPS, DNS, TCP and ICMP. A security vulnerability exists in Linux Prometheus Blackbox Exporter version v0.23.0 that stems from the inclusi...

TRIPLEPLAY Caveman 安全漏洞

TRIPLEPLAY Caveman is a commercial software platform for IPTV technology and video streaming from TRIPLEPLAY UK. A security vulnerability exists in TRIPLEPLAY Caveman prior to version 3.4.0 that stems from incorrect access control and can be exploited by an attacker to modify another user's...

PT-2023-20284 · Unknown · Tripleplay Platform

Name of the Vulnerable Software and Affected Versions: Tripleplay Platform versions prior to 3.4.0 Description: The issue allows an authenticated user to modify other users' passwords via a crafted request payload. This is due to incorrect access control in the platform. Recommendations: For...

PowerJob 安全漏洞

PowerJob is an open source distributed computing and job scheduling framework that allows developers to easily schedule tasks in their applications. A security vulnerability exists in PowerJob version V4.3.1 that stems from the presence of incorrect access control...

Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security, and environment. An access control error vulnerability...

Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security, and environment. An access control error vulnerability...

answer 安全漏洞

answer is an open source knowledge-based community software. An access control error vulnerability exists in versions of answer prior to 1.1.6, which stems from prolonged password expiration. An attacker could exploit the vulnerability to account account takeover...

PT-2023-21525 · Dell · Dell Ppdm

Name of the Vulnerable Software and Affected Versions: Dell PPDM versions 19.10 through 19.12 Description: The issue is related to improper access control. A remote authenticated malicious user with low privileges could potentially exploit this to bypass intended access restrictions and perform...

The vulnerability of Google Chrome’s Intents function allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Google Chrome’s Intents function is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially created web page...

PT-2023-3282 · Glpi +1 · Fields +1

Name of the Vulnerable Software and Affected Versions: Fields versions prior to 1.13.1 Fields versions prior to 1.20.4 Description: The issue is related to a lack of access control check in the Fields plugin for GLPI, allowing any authenticated user to write data to any fields container, includin...

The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to set arbitrary passwords for users of the system.

The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController. Exploiting this vulnerability allows a malicious actor to set arbitrary passwords for users of the system remotely...