9635 matches found
CVE-2024-6696
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses reads and/or writes to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad becau...
Pen testing avionics under ED-203a
The aviation industry realised some time ago that taking a standard approach to the cyber security of its products was needed and that this was a specialist discipline. A family of documents was produced to help with this: ED-202A / DO-326A – what should be certified ED-203A / DO-356A – how these...
CVE-2025-25968
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files...
CVE-2024-6696
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses reads and/or writes to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad becau...
Citrix Systems Secure Access 安全漏洞
Citrix Systems Secure Access is a secure access solution from Citrix Systems, Inc. A security vulnerability exists in Citrix Systems Secure Access that stems from improperly restricting application privileges. An attacker could read or modify sensitive data by exploiting the vulnerability...
CVE-2024-6696
Hitachi Vantara Pentaho Business Analytics Server exposes an authorization check flaw in the user console trash content across versions prior to 10.2.0.0 and 9.3.0.9 (including 8.3.x). The root cause is insufficient granularity in access controls (CWE-1220), allowing an attacker to bypass protect...
The vulnerability of Microsoft Edge relates to the redirection of URLs to unreliable websites when loading the login page, allowing attackers to circumvent existing security restrictions.
The vulnerability of Microsoft Edge relates to the redirection of URLs to unreliable websites when loading the login page. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions...
Improper Authorization
magento/community-edition and magento/project-community-edition are vulnerable to Improper Authorization. The vulnerability is due to insufficient access controls due to improper authorization enforcement, allowing an attacker to bypass security measures and escalate privileges, potentially leadi...
WordPress plugin Analytify 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2025-26789
An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...
CVE-2023-46694
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckeditor file manager functionality...
CVE-2025-26789
An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...
ABB Cylon FLXeon 9.3.4 Unauthenticated Dashboard Access
ABB Cylon FLXeon version 9.3.4 allows unauthenticated access to the Building Management System BMS or Building Automation System BAS dashboard. This exposes sensitive information, including system status, events, and alarms related to HVAC operations. Additionally, an attacker could manipulate...
CVE-2025-26789
CVE-2025-26789 affects Logpoint AgentX prior to 1.5.0. The root cause is inadequate access controls that allow li-admin users to access sensitive information about the AgentX Manager within a Logpoint deployment. Impact is limited to exposure of sensitive information (confidentiality), with no li...
RupeeWeb 安全漏洞
Rupeeseed RupeeWeb is a state-of-the-art web-based trading platform from Rupeeseed India. RupeeWeb suffers from a security vulnerability that stems from insufficient API endpoint privilege controls, allowing an authenticated, remote attacker to modify information on other user accounts...
CVE-2025-26789
An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...
CVE-2025-26789
An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...
PT-2025-7177 · Rupeeweb · Rupeeweb
Name of the Vulnerable Software and Affected Versions: RupeeWeb trading platform affected versions not specified Description: This issue exists due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation could allow an...
CVE-2024-34520
An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R10240, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls...
PT-2025-6644
Name of the Vulnerable Software and Affected Versions Mavenir SCE Application Provisioning Portal version PORTAL-LBS-R 1 0 24 0 Description The issue concerns an authorization bypass in the Mavenir SCE Application Provisioning Portal. This allows an authenticated 'guest' user to perform...