6442 matches found
cloudpanel-2.4.2-CVE-2024-44765-recovery
CVE-2024-44765 es una vulnerabilidad de Autorización Incorrecta Configuración Incorrecta de Control de Acceso en las versiones 2.0.0 a 2.4.2 de CloudPanel de MGT-COMMERCE GmbH 1. Siga las instrucciones en cada carpeta esto debe hacerse localmente 2. Restablecer contraseñas y accesos root@kitploit...
Exploit-CVE-2023-22518
Exploit-CVE-2023-22518 CVE-2023-22518 en Confluence CVE-2023-22518: Esta vulnerabilidad se describe como “una vulnerabilidad de autorización incorrecta en la base de datos y el servidor de Confluence”. El fallo afecta a las versiones On-premises de los productos Atlassian. Configuración del entor...
CVE-2023-22515
CVE-2023-22515 Información principal sobre CVE-2023-22515 Producto afectado: Atlassian Confluence Data Center & Confluence Server. Fecha de publicación: 04/10/2023. Gravedad: Critical CVSS 10.0. Tipo de vulnerabilidad: Broken Access Control / Improper Authorization → permite al atacante crear una...
Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
GHSA-J328-XMGP-J4Q3 Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
CVE-2018-13382
CVE-2018-13382 CVE-2018-13382 https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/ An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 under SSL VPN web portal allows an unauthenticated attacker to...
Kerberos-CVE-2026-27912
Kerberos-CVE-2026-27912 CVE-2026-27912 - Vulnerabilidad de elevación de privilegios de Windows Kerberos ResetNightmare - Restablecimiento de contraseña no autorizado mediante una falla en el protocolo de cambio de contraseña de Kerberos. 📋 Detalles Campo| Valor ---|--- CVE| CVE-2026-27912 Título|...
CVE-2023-22518
CVE-2023-22518 Vulnerabilidad de Autorización Incorrecta en Confluence Data Center y Server. Atlassian ha advertido a los administradores sobre una vulnerabilidad crítica en Confluence. La explotación de esta vulnerabilidad puede provocar pérdida de datos, por lo que el desarrollador recomienda...
CVE-2023-22518
CVE-2023-22518 Una herramienta de explotación para explotar servidores Confluence que son vulnerables a CVE-2023-22518, una vulnerabilidad de autorización incorrecta. Instalación: root@kitploit: git clone https://github.com/sanjai-AK47/CVE-2023-22518 cd CVE-2023-22518 python3 exploit.py Uso:...
CVE-2026-86779
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...
BIT-TOMCAT-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through...
BIT-TOMCAT-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0...
BIT-TOMCAT-2026-43515 Apache Tomcat: Security constraints not correctly applied
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu...
QNAP HBS 3 - Broken Access Control
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...
WordPress Easy Student Results <=2.2.8 - Improper Authorization
WordPress Easy Student Results plugin through 2.2.8 is susceptible to information disclosure. The plugin lacks authorization in its REST API, which can allow an attacker to retrieve sensitive information related to courses, exams, and departments, as well as student grades and information such as...
Tenda AC1200 V-W15Ev2 - Authentication Bypass
The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...
Jira - Incorrect Authorization
Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...
EUVD-2026-75781
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...