CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

CVE-2023-40610

CVE-2023-40610 affects Apache Superset prior to version 2.1.2. The issue is an improper authorization check that enables privilege escalation when using the default examples database connection, which can grant access to both the examples schema and Superset metadata DB. A specially crafted CTE S...

Improper Authorization

next-auth is vulnerable to Improper Authorization. A malicious actor could create an empty/mock user by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the next-auth.session-token cookie value with this non-related JWT woul...

Improper Authorization

strapi-plugin-protected-populate is vulnerable to Improper Authorization. The vulnerability is due to the protectPopulate function of protect-route.js, which allows a users to populate fields they don't have access, resulting in field-level security bypass...

WordPress My Sticky Bar Plugin < 2.6.5 Improper Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:premio:mystickymenu"; if description...

Adobe RoboHelp Server < 11.3 Improper Authorization Vulnerability (APSB22-31)

Adobe RoboHelp Server is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of the Apache Airflow network software, related to incorrect authorization, allows a hacker to modify any files they desire.

The vulnerability of the Apache Airflow network software is related to improper authorization. Exploiting this vulnerability allows a malicious actor to remotely modify arbitrary files...

CVE-2023-43582

Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access...

CVE-2023-43582

Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access...

Zoom Client < 5.16.0 Multiple Vulnerabilities (ZSB-23049, ZSB-23050, ZSB-23051, ZSB-23052, ZSB-23055) - Linux

The Zoom Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoom:zoom"; ifdescription...

Zoom Client < 5.16.0 Multiple Vulnerabilities (ZSB-23047, ZSB-23049, ZSB-23050, ZSB-23051, ZSB-23052, ZSB-23055) - Windows

The Zoom Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoom:zoom"; ifdescription...

CVE-2023-32662

Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privilaged user to potentially enable escalation of privilege via local access...

Authorization

Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privilaged user to potentially enable escalation of privilege via local access...

CVE-2023-28378

Improper authorization in some IntelR QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-32662

CVE-2023-32662 affects Intel Battery Life Diagnostic Tool installation software prior to version 2.2.1. The root cause is improper authorization in the installer, potentially allowing a privileged local user to escalate privileges. Affected product: Intel Battery Life Diagnostic Tool software bef...

CVE-2023-36633

An improper authorization vulnerability CWE-285 in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests...

CVE-2023-36633

An improper authorization vulnerability CWE-285 in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests...

CVE-2023-36633

An improper authorization vulnerability CWE-285 in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests...

Zoom Client for Meetings < 5.16.0 Vulnerability (ZSB-23055)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.16.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-23055 advisory. - Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via...

PT-2023-6938 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom affected versions not specified Description: The issue is related to improper authorization in some Zoom clients, which may allow an authorized user to conduct an escalation of privilege via network access. This is due to deficiencies in...