PT-2024-12687 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in GET, PUT, DELETE "/settings/settingName" allows a low privileged user to fetch, modify or delete the settings of any user,...

PT-2024-12685

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "GET, PUT, DELETE /secretaries/secretaryId" endpoint allows a low-privileged user to fetch, modify, or delete a low-privileged...

CVE-2023-38050: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38053: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /settings/settingName allows a low privileged user to fetch, modify or delete the settings of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3285: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

PT-2024-12370 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "POST /customers" endpoint allows a low-privileged user to create a new low-privileged user customer in the system, resultin...

CVE-2023-38048: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38051: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3290: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3289: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

PT-2024-12367

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description A BOLA vulnerability in the "POST /services" endpoint allows a low-privileged user to create a service for any user in the system, including admin, resulting in unauthorized data manipulatio...

CVE-2023-38054: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

PT-2024-12681

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "GET, PUT, DELETE /categories/categoryId" endpoint allows a low-privileged user to fetch, modify, or delete the category of an...

PT-2024-12345

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "POST /secretaries" endpoint allows a low-privileged user to create a low-privileged user secretary in the system, resulting i...

CVE-2023-3286: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

PT-2024-12344 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A BOLA vulnerability in the "POST /appointments" endpoint allows a low-privileged user to create an appointment for any user in the system, including administrators. This results in...

PT-2024-12688 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /customers/customerId" endpoint allows a low-privileged user to fetch, modify, or delete a customer,...

CVE-2023-41918

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918 Missing Authentication for Critical Function in Kiloview P1/P2 devices

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918

CVE-2023-41918 is linked to Kiloview P1/P2 devices. Multiple connected sources describe unauthenticated access to functionality inadequately constrained by ACLs, potentially enabling unauthenticated command execution, data manipulation, or access to privileged functions. Some documents allege bro...