CVE-2021-38516

Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D7800 before 1.0.1.44, D8500 before 1.0.3.43, DC112A before 1.0.0.40, DGN2200v4 before 1.0.0.108, RBK50 before 2.3.0.32, RBR50...

WordPress 访问控制错误漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress Workreap theme versions prior to 2.2.2, which stems...

The vulnerability of the Zabbix universal monitoring system, related to deficiencies in access control, allows a intruder to bypass the authentication process on the administrator panel.

The vulnerability of the Zabbix universal monitoring system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass the administrative panel’s authentication process by sending specially crafted requests...

The vulnerability of the Mozilla Firefox browser for Android, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of the Mozilla Firefox browser for Android is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

CVE-2021-33327

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibilit...

Fortinet FortiManager 和 Fortinet FortiAnalyzer 访问控制错误漏洞

Fortinet FortiManager is a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager and FortiAnalyzer have an access control error vulnerability that could be exploited by an attacker to retrieve the list ...

Remote Code Execution (RCE)

accesscontrol is vulnerable to remote code execution. Having full access to Python's string module allows users with admin-level Zope "Manager" role to access to the class Formatter, which can be overridden and extended within Script Python in a way that provides access to other unsafe Python...

CVE-2021-28674

The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node outside of the attacker's perimeter via an account with write permissions. This occurs because node IDs are predictable with incrementing numbers and the access control on...

CVE-2021-28095

OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32...

Dell EMC Isilon OneFS 和 EMC PowerScale 权限许可和访问控制问题漏洞

DELL Dell EMC Isilon OneFS and EMC PowerScale are both a set of horizontally scalable storage systems for unstructured data from Dell USA. A privilege permission and access control issue vulnerability exists in Dell EMC Isilon OneFS and PowerScale OneFS, which stems from Dell EMC Isilon OneFS...

Beckhoff Automation GmbH & Co. KG CX9020 安全漏洞

The Beckhoff Automation GmbH & Co. KG CX9020 is a compact DIN rail-mounted Ethernet control system with a 1 GHz ARM Cortex™-A8 CPU from Beckhoff, Germany. A security vulnerability exists in the Beckhoff Automation GmbH & Co. KG CX9020 that stems from incorrect access control. The vulnerability...

Red Hat Wildfly 访问控制错误漏洞

Red Hat Wildfly is a lightweight JavaEE-based open source application server from Red Hat USA. An access control error vulnerability exists in WildFly Core that stems from improperly restricting access to Vault expressions. If a Vault expression takes the form of a single attribute containing...

SAMSUNG FactoryCameraFB 安全漏洞

Samsung FactoryCameraFB is a system application from Samsung South Korea. An access control error vulnerability exists in Samsung Mobile FactoryCameraFB. An attacker could use this vulnerability to allow an untrusted application to access arbitrary files with escalated privileges...

UBUNTU-CVE-2021-22228

An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql...

D-Link DSL-2888A 访问控制错误漏洞

The D-LINK DSL-2888A is a unified services router from D-link China.A security vulnerability exists in the D-LINK DSL-2888A, which could be exploited by attackers to make unauthorized changes to the administrator user's password...

The vulnerability of the Apache OpenOffice office software, related to deficiencies in access control, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache OpenOffice office software is related to deficiencies in handling hyperlinks. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information through specially created documents containing hyperlinks...

Design/Logic Flaw

In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the route...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the vManage web interface of the Cisco SD-WAN software-defined network is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information by sending specially crafted requests...

The vulnerability of the AVPNC_RP VPN-client Aviatrix VPN Client allows a perpetrator to enhance their privileges or execute arbitrary code.

The vulnerability of the AVPNCRP VPN client from Aviatrix VPN is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges or execute arbitrary code...