6393 matches found
Improper Authorization in janeczku/calibre-web
Description With default settings, low-level users will not have permission to edit the sort order of books in private shelf of another user. However, due to incorrect checking, the application does not work as intended. Proof of Concept - Step 1: Login with admin account and go to...
Improper Authorization in liukuo362573/yishaadmin
Description When downloading files using the /admin/File/DownloadFile?filePath= URI, you're able to download any file you want, as long as you know the path of the file, even as an unauthenticated user. This means that an unauthenticated user could download the /etc/passwd/ file or any file that...
Improper Authorization in liukuo362573/yishaadmin
Description Hi there, there is another Improper authorization in /admin/OrganizationManage/Department/GetFormJson Proof of Concept 1. Open link http://106.14.124.170/admin/OrganizationManage/Department/GetFormJson?id=16508640061124402 without logging in demo page. 2. See that department data is...
Improper Authorization in liukuo362573/yishaadmin
Description Hi there yisshadmin team, I would like to report an improper authorization in yishaadmin source code. The link /admin/ToolManage/Server/ServerIndex requires no authorization and available for anyone to view server information like IP, RAM, CPU... Proof of Concept 1. Access the link...
CVE-2022-22288
Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...
CVE-2022-22288
Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...
CVE-2022-22288
Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...
CVE-2022-22272
Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...
CVE-2022-22272
Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...
CVE-2022-22272
Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...
Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password...
Samsung SMR 安全漏洞
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in Samsung SMR that originates from improper authorization in TelephonyManager and allows an attacker to gain access to IMSI without the...
CVE-2022-22288
CVE-2022-22288 affects Samsung Galaxy Store; vulnerability is an improper authorization flaw in Galaxy Store prior to version 4.5.36.5 that enables remote installation from the allowlist. Root cause per sources is improper authorization allowing an attacker to trigger installations without proper...
CVE-2022-22288
Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...
CVE-2022-22272
CVE-2022-22272 affects TelephonyManager in Samsung/Android prior to the SMR Jan-2022 Release 1. The issue is improper authorization that allows an attacker to obtain the IMSI without READ_PRIVILEGED_PHONE_STATE permission. Root cause is insufficient access control in TelephonyManager’s handling o...
CVE-2022-22272
Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...
PT-2022-15318 · Unknown · Telephonymanager
Name of the Vulnerable Software and Affected Versions: TelephonyManager versions prior to SMR Jan-2022 Release 1 Description: The issue is related to improper authorization in TelephonyManager, allowing attackers to obtain the IMSI without the required READ PRIVILEGED PHONE STATE permission...
PT-2022-15332 · Samsung · Galaxy Store
Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.36.5 Description: The issue is related to an improper authorization vulnerability. It allows for remote app installation from the allowlist. Recommendations: For Galaxy Store versions prior to 4.5.36.5, upda...
GHSA-83X4-9CWR-5487 Improper Authorization in Keycloak
A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled...