Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A security bypass vulnerability exists in Huawei...

The vulnerability of Juniper Networks’ Junos OS, related to improper authorization, allows attackers to bypass Juniper’s Deep Packet Inspection (JDPI) rules and gain unauthorized access to networks or resources.

The vulnerability of Juniper Networks’ Junos OS is related to improper authorization. Exploiting this vulnerability allows a malicious actor to bypass Juniper’s Deep Packet Inspection JDPI rules and gain access to unauthorized networks or resources...

Improper Authorization

org.keycloak:keycloak-server-spi-private and org.keycloak:keycloak-services are vulnerable to Improper Authorization. The vulnerability exists under certain pre-conditions which allows an attacker to bypass authentication mechanisms via retrieving an access token for other OAuth clients, by using...

Improper Authorization in add role function leads to privilege escalation

Description The application improperly performs user authorization, resulting in a user with the user management role being able to modify their own permissions or those of others. Proof of Concept Step1: The highest-level administrator or an administrator with the permission to create roles...

Improper Authorization in Export role function

Description The application controls user rights incorrectly, leading to the attacker being able to collect sensitive information. Proof of Concept Step1: The administrator user accesses the user role management function and performs the 'export role' operation. Step2: Upon observation, a HTTP...

The vulnerability of the GLPI system’s request and incident handling process, related to improper authorization, allows a malicious actor to escalate their privileges within the application.

The vulnerability of the GLPI request and incident handling system is related to the absence of an authorization mechanism that allows users with the “Technical Specialist” profile to view and generate a personal token for the superadministrator. Exploiting this vulnerability could enable a...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper handling of authorization logic. An attacker can bypass security measures and access sensitive user data without requiring user...

Missing Support for Integrity Check

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Missing Support for Integrity Check due to improper handling of authorization checks. An attacker can bypass security features and access restricted functionalities without...

CVE-2023-28175

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request...

CVE-2023-28175

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request...

Authorization

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request...

Improper Authorization leads to privilege escalation

Description The application improperly performs user authorization, resulting in a user with the user management role being able to modify their own permissions or those of others. Proof of Concept Step1: The highest-level administrator or an administrator with the permission to create roles...

CVE-2023-28175

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request...

CVE-2023-28175

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request...

CVE-2023-0837

An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. This can result in unwanted changes to the configuration...

Authorization

An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. This can result in unwanted changes to the configuration...

CVE-2023-2638

Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may allow a local, authenticated non-admin...

CVE-2023-2638 Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack

Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may allow a local, authenticated non-admin...

PT-2023-3710 · Unknown · Sspanel-Uim

Name of the Vulnerable Software and Affected Versions: SSPanel-Uim version 2023.3 Description: The issue is related to improper authorization in the /link/ interface of the SSPanel-Uim software. This can allow an attacker to gain access to confidential information, potentially leading to a leak o...

PT-2023-3651 · Rockwell Automation · Factorytalk System Services

Name of the Vulnerable Software and Affected Versions: FactoryTalk System Services affected versions not specified Description: The issue is related to improper authorization in the FTSSBackupRestore.exe executable, which may allow a local, authenticated non-admin user to load malicious...