287 matches found
CVE-2021-41503
DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This...
Information disclosure
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user guest, standard, or admin to view and modify information...
CVE-2021-37709
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding securit...
CVE-2021-25954
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint...
CVE-2021-37213
The check-in record page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record...
CVE-2021-36276
Dell DBUtilDrv2.sys driver versions 2.5 and 2.6 contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required...
Insecure Access Controls
github.com/argoproj/argo-cd uses insecure access controls. The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-brute-force measures. An attacker is able to repeatedly perform authentication attempts to discover user credentials...
Insecure Access Control
directmailteam/direct-mail uses insecure access controls. The extension fails to check if an authenticated backend user has access to newsletter subscriber tables e.g. ttaddress, feusers when using the CSV export function of the extension...
Insecure Access Control
chromium is uses an insecure access control. An insufficient policy enforcement was found in the Android intents component, allowing an attacker to bypass security restrictions...
Insecure Access Control
github.com/containerd/containerd uses insecure access controls. Pulling of malicious image can cause Unix file permission changes for existing files in the host's file system. This can result in restriction of access to files which should otherwise by accessible...
Insecure Access Control
github.com/pterodactyl/wings allows insecure access to endpoints. An attacker is able to access resources on local networks that would otherwise be inaccessible due to lack of hostname verification...
Emmanuel MyDomoAtHome 安全漏洞
GitLab Emmanuel MyDomoAtHome is a GitLab open source application. A REST interface to ImperoHome with Domoticz ISS. Emmanuel MyDomoAtHome has a security vulnerability that stems from incorrect access control implementation. An unauthenticated, remote attacker could use the vulnerability could...
Insecure Access Controls
@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...
Insecure Access Control
mediawiki uses an insecure access control. A user is able to protect a page to a higher level than they currently have permissions for...
Content Spoofing
chromium is vulnerable to content spoofing. An insecure access control allows an attacker who has compromised the renderer process to spoof contents of the Omnibox via a malicious HTML page...
Insecure Access Control
shinobi uses insecure access controls. An attacker is able to access the User/Admin/Super API functions through the use of JS Proto Method names held in an internal JS Object and trick the System into accepting supplied API Key that exists in the underlying JS object...
CVE-2021-27509
In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code...
Insecure Access Controls
Xen is vulnerable to denial of service. Unprivileged guest users are able to obtain and modify permissions, list and delete root nodes. This is due to permissions that are not properly enforced...
Privilege Escalation
odoo is vulnerable to privilege escalation. Insecure access controls allows remote authenticated users with access to contact management to modify user accounts, resulting in the attacker obtaining higher privileges...