CVE-2024-2098

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected fil...

CVE-2024-2098 Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected fil...

CVE-2024-2098

CVE-2024-2098 affects the WordPress Download Manager plugin. The flaw is an improper authorization check in protectMediaLibrary, impacting all versions up to and including 3.2.89 and enables unauthenticated attackers to download password‑protected files. A fixed release exists (3.2.90) per Patchs...

CVE-2024-2098 Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected fil...

CVE-2024-25949

Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. A remote authenticated attacker could potentially exploit this vulnerability leading to escalation of privileges...

CVE-2024-25949

Dell OS10 Networking Switches (versions 10.5.3.x to 10.5.6.x) are affected by an improper authorization vulnerability that could allow a remote authenticated attacker to achieve privilege escalation. The issue is documented across multiple sources (including NVD, CNNVD and PT-2024-21238) and Dell...

CVE-2024-25949

Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. A remote authenticated attacker could potentially exploit this vulnerability leading to escalation of privileges...

WordPress Download Manager plugin <= 3.2.89 - Improper Authorization via protectMediaLibrary vulnerability

Improper Authorization via protectMediaLibrary vulnerability discovered by m1tz in WordPress Plugin Download Manager versions = 3.2.89...

PT-2024-21238 · Dell · Dell Os10 Networking Switches

Name of the Vulnerable Software and Affected Versions: Dell OS10 Networking Switches versions 10.5.3.x through 10.5.6.x Description: The issue is related to an improper authorization vulnerability. A remote authenticated attacker could potentially exploit this vulnerability, leading to escalation...

Improper Authorization

zenml is vulnerable to Improper Authorization. The vulnerability is due to improper authorization controls in the API PUT /api/v1/users/id endpoint, allowing any authenticated user to modify other users' information, including deactivating accounts...

CVE-2024-37176

SAP BW/4HANA Transformation and Data Transfer Process DTP allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low...

PT-2024-24050 · Cybozu · Cybozu Garoon

Name of the Vulnerable Software and Affected Versions: Cybozu Garoon versions 5.0.0 through 6.0.0 Description: The issue allows a remote authenticated attacker to alter and/or obtain the data of Memo due to an incorrect authorization vulnerability. Recommendations: For Cybozu Garoon versions 5.0....

PT-2026-39283

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.1.124 Description An improper authorization control exists where the API fails to validate if a user possesses an authorized role of user or admin. When the platform is configured to allow new sign-ups, new...

PT-2024-4180 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description: The issue is related to an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability...

lunary-ai/lunary allows users unauthorized access to projects

Withdrawn: This advisory was incorrectly linked the the npm package lunary. The advisory is valid, but not for that packlage. In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organizatio...

GHSA-W5XM-MX47-V7C8 lunary-ai/lunary allows users unauthorized access to projects

Withdrawn: This advisory was incorrectly linked the the npm package lunary. The advisory is valid, but not for that packlage. In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organizatio...

CVE-2024-4146

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146

In Lunary (lunary-ai/lunary) v1.2.13, CVE-2024-4146 describes an incorrect authorization vulnerability in the checkProjectAccess middleware. The vulnerability relies on only verifying organization membership and fails to enforce explicit project-level permissions checked via the account_project t...

WordPress Strong Testimonials plugin <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification vulnerability

AuthenticatedContributor+ Improper Authorization to Views Modification vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Strong Testimonials versions = 3.1.12...