CVE-2025-2498 Insufficient Granularity of Access Control in GitLab

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions...

Improper Access Control

umbraco.cms.api.delivery is vulnerable to improper access control. The vulnerability is due to output caching not varying by the API key authorization header, which allows an attacker to access cached API responses without a valid key if they were previously requested by an authorized user...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 12.0 through prior to 18.0.6, 18.1 through prior to 18.1.4, and 18.2 through prior to 18.2.2, which stems from improper access contro...

PT-2025-33048 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.0 through 18.0.5 GitLab EE versions 18.1 through 18.1.3 GitLab EE versions 18.2 through 18.2.1 Description: An improper access control issue exists in GitLab EE. Under certain conditions, users could view assigned issues...

CVE-2025-53729

Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally...

CVE-2025-53729

Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally...

CVE-2025-49707

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally...

CVE-2025-24999

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control in certain device plugins, which can allow denial of service. Remediation Upgrade github.com/intel/intel-device-plugins-for-kubernetes/cmd/internal/labeler to version 0.32.0 or higher. References - GitHub Commit ...

CVE-2025-24840

Improper access control for some Edge Orchestrator software before version 24.11.1 for IntelR TiberTM Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2025-24323

Improper access control in some firmware package and LED mode toggle tool for some IntelR PCIe Switch software before version MR41.0b1 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-20099

Improper access control for some IntelR Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-49707

CVE-2025-49707 describes an improper access control in Azure Virtual Machines that could allow an authorized attacker to perform spoofing locally. The initial description confirms the vulnerability in Azure VMs, with connected sources noting Microsoft has released fixes for related Azure vulnerab...

CVE-2025-24999

CVE-2025-24999 is implicated in Microsoft SQL Server Elevation of Privilege via improper access control, enabling an authorized user to escalate privileges over a network. Public details confirm impact surface across SQL Server versions affected by the 2025 security updates; remediation is provid...

CVE-2025-53729

The CVE-2025-53729 entry concerns an Elevation of Privilege in Microsoft Azure File Sync. The vulnerability affects the Azure File Sync Agent on Windows Server installations prior to the 18.3 release (v18.3.0.0 fixes the issue; versions up to 18.2 and earlier are affected). The underlying problem...

CVE-2025-24840

CVE-2025-24840 describes an improper access control vulnerability in Intel’s Edge Orchestrator software for the Intel® Tiber™ Edge Platform, affecting versions before 24.11.1. An unauthenticated user may potentially escalate privileges via adjacent access. The issue is documented with a middle/lo...

CVE-2025-24323

Improper access control in some firmware package and LED mode toggle tool for some IntelR PCIe Switch software before version MR41.0b1 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-24323

The CVE-2025-24323 issue affects Intel(R) PCIe Switch software (firmware package and LED mode toggle tool) prior to MR4_1.0b1. The root cause is improper access control, enabling a local, privileged user to escalate privileges. Impact is described as escalation of privilege with local access (no ...

CVE-2025-24313

Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may allow a privileged user to potentially enable denial of service via local access...

CVE-2025-24313

CVE-2025-24313 affects Intel Device Plugins for Kubernetes prior to version 0.32.0. The root cause is improper access control in certain device plugin components, which can allow a privileged local attacker to trigger a denial of service, affecting availability. The official Intel advisory and co...