6440 matches found
Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
Kerberos-CVE-2026-27912
Kerberos-CVE-2026-27912 CVE-2026-27912 - Windows Kerberos 权限提升漏洞 ResetNightmare - 通过 Kerberos 更改密码协议缺陷实现未授权密码重置 📋 详情 字段| 值 ---|--- CVE| CVE-2026-27912 标题| Windows Kerberos 权限提升漏洞 CVSS| 8.0 HIGH CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE| CWE-285：授权不当 发布日期| 2026年4月14日 已修补| 2026年4月 🔍 攻击流程...
CVE-2023-22518
CVE-2023-22518 Confluence Data Center 和 Server 中的权限分配不当漏洞。 Atlassian 已警告管理员关于 Confluence 中严重漏洞。利用此漏洞可能导致数据丢失，因此开发者建议您立即安装补丁。 请注意，该漏洞无法用于泄露数据，并且不会影响通过 atlassian.net 域名访问的 Atlassian Cloud 站点。 漏洞详情 Atlassian Jira 页面 产品| 受影响版本| 已修复版本 ---|---|--- Confluence Data Center| 所有版本均受影响| 7.19.16 及以上 Confluenc...
CVE-2023-22518
CVE-2023-22518 CVE-2023-22518 不適切な認可の脆弱性に脆弱なConfluenceサーバーを悪用するためのエクスプロイトツール インストール: root@kitploit: git clone https://github.com/sanjai-AK47/CVE-2023-22518 cd CVE-2023-22518 python3 exploit.py 使用法: root@kitploit: python3 exploit.py -h usage: exploit.py -h -d DOMAIN -dL DOMAINSLIST -o OUTPUT -to...
CVE-2026-86779
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...
BIT-TOMCAT-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through...
BIT-TOMCAT-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0...
BIT-TOMCAT-2026-43515 Apache Tomcat: Security constraints not correctly applied
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu...
QNAP HBS 3 - Broken Access Control
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...
WordPress Easy Student Results <=2.2.8 - Improper Authorization
WordPress Easy Student Results plugin through 2.2.8 is susceptible to information disclosure. The plugin lacks authorization in its REST API, which can allow an attacker to retrieve sensitive information related to courses, exams, and departments, as well as student grades and information such as...
Jira - Incorrect Authorization
Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...
Tenda AC1200 V-W15Ev2 - Authentication Bypass
The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...
cloudpanel-2.4.2-CVE-2024-44765-recovery
CVE-2024-44765 es una vulnerabilidad de Autorización Incorrecta Configuración Incorrecta de Control de Acceso en las versiones 2.0.0 a 2.4.2 de CloudPanel de MGT-COMMERCE GmbH 1. Siga las instrucciones en cada carpeta esto debe hacerse localmente 2. Restablecer contraseñas y accesos root@kitploit...
CVE-2023-22515
CVE-2023-22515 关于 CVE-2023-22515 的主要信息 受影响产品: Atlassian Confluence Data Center & Confluence Server。 公开日期: 2023年10月4日。 严重程度: Critical（CVSS 10.0）。 漏洞类型: Broken Access Control / Improper Authorization → 允许攻击者远程创建管理员账户 。 漏洞位于 Confluence setup 机制 中。 影响范围: Confluence Data Center & Server 8.0.0 → 8.5.1 ...
EUVD-2026-75791
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization...
EUVD-2026-75781
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
EUVD-2026-75785
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization...
PT-2026-89785
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...
Exploit-CVE-2023-22518
Exploit-CVE-2023-22518 CVE-2023-22518 在 Confluence 中 CVE-2023-22518：该漏洞被描述为“Confluence 数据库和服务器中授权不当的漏洞”。该错误影响 Atlassian 产品的本地部署（On-premises）版本。 设置环境 使用受影响版本 8.0.4 下载 URL： https://product-downloads.atlassian.com/software/confluence/downloads/atlassian-confluence-8.0.4-x64.exe 选择 Trial...