CVE-2023-48860

TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code...

PT-2023-27146 · Ericsson · Ericsson Network Manager

Name of the Vulnerable Software and Affected Versions: Ericsson Network Manager versions prior to 23.2 Description: The issue is related to mishandled Access Control, allowing unauthenticated low-privilege users to access the NCM application. Recommendations: For versions prior to 23.2, update to...

CVE-2023-37572

Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSFdiscovery service. The service executable could be changed or the service could be deleted...

The vulnerability of operating systems such as iOS, iPadOS, macOS, and the browser Safari, related to lack of access control, allows attackers to disclose protected information.

The vulnerability of the Web page rendering module in WebKit operating systems for iOS, iPadOS, macOS, and the Safari browser is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to disclose protected information processed from web content...

The vulnerability of the command-line interface (CLI) of microprogramming software for network devices such as ZyXEL VPN, USG FLEX, and ATP allows a intruder to gain unauthorized access to protected information.

The vulnerability of the command-line interface CLI of microprogrammed network devices such as ZyXEL VPN, USG FLEX, and ATP is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

CVE-2023-37890

Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge...

LOYTEC LINX-212 Security Vulnerability

The LOYTEC LINX-212 is a building controller from LOYTEC. A security vulnerability exists in the LOYTEC LINX-212 version 6.2.4 and LINX-151 version 7.2.4, which stems from an access control error vulnerability in the file dpalconfig.zml. An attacker can exploit the vulnerability to disclose...

Dell OS Recovery Tool 安全漏洞

Dell OS Recovery Tool is an operating system recovery tool from Dell USA. An Access Control Error vulnerability exists in Dell OS Recovery Tool versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0, which stems from the presence of improper access control. A locally authenticated, non-administrator...

CVE-2023-47250

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers with access to a VNC session to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop,...

CVE-2023-47250

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers with access to a VNC session to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop,...

CVE-2023-47392

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request...

Mercedes-Benz Mercedes me Security Breach

Mercedes-Benz Mercedes me is an automotive software from Mercedes-Benz Germany. A security vulnerability exists in Mercedes-Benz Mercedes me v1.34.0 and prior versions, which stems from an access control issue that allows an attacker to view another user's maintenance orders and access sensitive...

PT-2023-9699

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 27.1.9 Nextcloud Server versions prior to 28.0.5 Nextcloud Server versions prior to 29.0.0 Nextcloud Enterprise Server versions prior to 21.0.9.18 Nextcloud Enterprise Server versions prior to 22.2.10.23...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition version v9.0, which stems from the presence of a corrupted access...

The vulnerability of the kernel driver (pdfwkrnl.sys) of AMD Radeon graphics processors allows a hacker to escalate their privileges and execute arbitrary code.

The vulnerability of the kernel driver pdfwkrnl.sys of AMD Radeon graphics processors is related to deficiencies in access control. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary code by sending specially crafted IOCTL requests...

CVE-2023-34982

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

CVE-2023-41570

MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API...

CVE-2023-29157

Improper access control in some IntelR OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access...

runc: Rootless runc makes `/sys/fs/cgroup` writable

A flaw was found in runc, where it is vulnerable to a denial of service caused by improper access control in the /sys/fs/cgroup endpoint. This flaw allows a local authenticated attacker to cause a denial of service...

kernel: out-of-bounds write in qfq_change_class function

An out-of-bounds memory access flaw was found in the Linux kernel’s traffic control QoS subsystem in how a user triggers the qfqchangeclass function with an incorrect MTU value of the network device used as lmax. This flaw allows a local user to crash or potentially escalate their privileges on t...