9530 matches found
SAMSUNG Mobile devices security vulnerability
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, and more, from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices SMR Dec-2023 Release 1 version, which stemmed from an improper authorization...
CVE-2023-5808: Improper Authorization
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative...
Improper Authorization
openjdk is vulnerable to Improper Authorization. An unauthenticated attacker with network access via multiple protocols is able to potentially compromise the system and gain unauthorized access to some data. This vulnerability requires human interaction and primarily affects Java deployments...
Improper Authorization
openjdk is vulnerable to Improper Authorization. An unauthenticated attacker with network access is able to potentially compromise affected systems and gain unauthorized access to data. This vulnerability can be exploited through APIs and applies to Java deployments relying on the Java sandbox fo...
CVE-2023-40610
CVE-2023-40610 affects Apache Superset prior to version 2.1.2. The issue is an improper authorization check that enables privilege escalation when using the default examples database connection, which can grant access to both the examples schema and Superset metadata DB. A specially crafted CTE S...
CVE-2023-40610 Apache Superset: Privilege escalation with default examples database
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...
CVE-2023-40610: Incorrect Authorization
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...
Improper Authorization
next-auth is vulnerable to Improper Authorization. A malicious actor could create an empty/mock user by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the next-auth.session-token cookie value with this non-related JWT woul...
Improper Authorization
strapi-plugin-protected-populate is vulnerable to Improper Authorization. The vulnerability is due to the protectPopulate function of protect-route.js, which allows a users to populate fields they don't have access, resulting in field-level security bypass...
WordPress My Sticky Bar Plugin < 2.6.5 Improper Authorization Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:premio:mystickymenu"; if description...
CVE-2023-48309: Improper Authorization
NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...
CVE-2023-48241: Improper Authorization
XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wiki...
Adobe RoboHelp Server < 11.3 Improper Authorization Vulnerability (APSB22-31)
Adobe RoboHelp Server is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
The vulnerability of the Apache Airflow network software, related to incorrect authorization, allows a hacker to modify any files they desire.
The vulnerability of the Apache Airflow network software is related to improper authorization. Exploiting this vulnerability allows a malicious actor to remotely modify arbitrary files...
CVE-2023-43582
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access...
CVE-2023-43582
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access...
CVE-2023-30954: Improper Authorization
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized...
Zoom Client < 5.16.0 Multiple Vulnerabilities (ZSB-23047, ZSB-23049, ZSB-23050, ZSB-23051, ZSB-23052, ZSB-23055) - Windows
The Zoom Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoom:zoom"; ifdescription...
Zoom Client < 5.16.0 Multiple Vulnerabilities (ZSB-23049, ZSB-23050, ZSB-23051, ZSB-23052, ZSB-23055) - Linux
The Zoom Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoom:zoom"; ifdescription...