PT-2024-11900 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions 2.0.0 through 2.0.1 Description: A vulnerability was found in the Configuration Center component, affecting some unknown functionality of the file /users. This issue leads to improper authorization and can be exploited remotel...

Improper Authorization

pimcore/customer-data-framework is vulnerable to Improper Authorization. The vulnerability is due to insufficient permission enforcement for with the /admin/customermanagementframework/gdpr-data/search-data-objects endpoint. An authenticated user without permission to access this endpoint can que...

Improper Authorization

pimcore/customer-management-framework-bundle is vulnerable to Improper Authorization. The vulnerability is caused due to improper authorization checks within DuplicatesController.php. This allows authenticated and unauthorized user to access the list of potential duplicate users and see their dat...

Improper Authorization

aries-cloudagent is vulnerable to Improper Authorization. The vulnerability is due to improper verification of credentials when a user presents incorrectly constructed proofs. This allows malicious verifiers to save and replay unauthorized presentations...

CVE-2024-21735 Improper Authorization check in SAP LT Replication Server

SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impac...

Improper authorization for HA requests

...

Improper Authorization

github.com/mattermost/mattermost/ is vulnerable to Improper Authorization. The vulnerability is caused when user receives updated permissions during active session. This freshly demoted guest can change group names...

GitLab 13.4 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22253)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions...

GitLab 12.6 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22256)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status CVE-2021-22256 Note that Nessus has not tested fo...

GitLab < 14.8.6 (CVE-2022-1124)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to...

GitLab 13.1 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22244)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data CVE-2021-22244 Note that Nessus has not tested...

CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

Improper Authorization

Gitlab is vulnerable to Improper Authorization. It is possible for unauthorized users to view public project release descriptions via atom endpoint...

CVE-2023-50332

Improper authorization vulnerability exists in the User Management /admin/users page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention...

CVE-2023-50332

GROWI contains an improper authorization vulnerability (CVE-2023-50332) on the User Management page (/admin/users) that could allow a user to delete or suspend their own account in versions prior to 6.0.6. Root cause is an authorization flaw in the /admin/users endpoint. The issue is documented a...

Improper Authorization

gitlab is vulnerable to Improper Authorization. It is possible for a removed project member to write to protected branches by using deploy keys...

PT-2023-31532 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.6 Description: An improper authorization issue exists in the User Management page, specifically at the /admin/users endpoint. This issue can lead to unintended deletion or suspension of a user's account...

PT-2023-31799 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7 through 3.17.18 GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server...

Unauthorized Access

apache-superset is vulnerable to Unauthorized Access. The vulnerability is due to improper authorization checks. This flaw can be exploited by an attacker by creating a dashboard and adding charts to it. Consequently they become one of the owners of the charts, resulting in unauthorized write...

Atlassian Confluence Improper Authorization / Code Execution Exploit

This improper authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to the Confluence instance administrator. This...