64278 matches found
CVE-2025-14660
A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argument domain causes improper access controls. The attack can b...
CVE-2025-14660 DecoCMS Mesh Workspace Domain api.ts createTool access control
A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argument domain causes improper access controls. The attack can b...
PT-2025-51162
A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argument domain causes improper access controls. The attack can b...
Improper Access Control
mad-proxy is vulnerable to Improper Access Control. The vulnerability is due to flaws in HTTP/HTTPS traffic interception logic, allowing attackers to bypass security policies and evade traffic inspection, potentially exposing sensitive data...
Improper Access Control
apacheairflow is vulnerable to improper access control. The vulnerability is due to insufficient authorization checks in the bulk create API with the overwrite action, which allows an attacker with only CREATE privileges to update existing Pools, Connections, and Variables without having UPDATE...
Improper Access Control
Doris MCP Server is vulnerable to Improper Access Control. The vulnerability is due to an attacker with a valid read-only account being able to bypass Doris MCP Server’s read-only mode, where they can perform unauthorized modifications, and attackers with read-only access may perform unauthorized...
Improper Access Control
mcp MCP Python SDK is vulnerable to Improper Access Control. The vulnerability is due to DNS rebinding protection not being enabled by default for HTTP-based servers, allowing a malicious website to bypass same-origin policy and send requests to a local MCP server running without authentication,...
Improper Access Control
mineadmin/mineadmin is vulnerable to Improper Access Control. The vulnerability is due to insecure permission settings in the scheduled tasks feature, which allows an attacker to execute arbitrary commands and potentially achieve full account takeover...
Improper Access Control
mantisbt/mantisbt is vulnerable to improper access control. The vulnerability is due to insufficient access-level checks, which allows an attacker to exploit the Copy From functionality to retrieve column configurations from private projects without authorization...
Improper Access Control
getgrav/grav is vulnerable to improper access control. The vulnerability is due to insufficient restriction on the "Frontmatter" form, which allows a low-privileged user to read sensitive server files and exploit them to compromise user accounts...
Improper Access Control
dnn.platform is vulnerable to improper access control. The vulnerability is due to the default HTML editing configuration allowing unauthenticated file uploads, which allows an attacker to upload arbitrary files and potentially leverage them for further compromise...
Improper Access Control
Liferay Portal is vulnerable to improper access control. The vulnerability is due to APIs not restricting access before a user verifies their email address, which allows a remote attacker to access and modify content through the API without proper verification...
Improper Access Control
com.blazemeter.plugins, BlazeMeterJenkinsPlugin is vulnerable to Improper Access Control. The vulnerability is due to insufficient permission checks in the Jenkins UI, which allows an attacker to view sensitive resource identifiers such as credential IDs, workspaces, and project IDs without prope...
CVE-2025-67740
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata...
WordPress Animation Addons for Elementor plugin SQL Injection Vulnerability
WordPress Animation Addons for Elementor plugin is an Elementor page builder extension plugin for the WordPress platform, focused on adding rich animation effects to websites. The WordPress Animation Addons for Elementor plugin suffers from a SQL injection vulnerability that stems from improper...
Plesk 安全漏洞
Plesk is a web hosting control panel from the Swiss company Plesk. A security vulnerability exists in Plesk version 18.0 that stems from improper access control...
CVE-2025-64669
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally...
CVE-2025-64669
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally...
