PT-2024-6925 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access control in the Winlogon program of Windows operating systems. It allows an attacker to elevate their privileges. Recommendations: At the moment,...

PT-2024-30170 · Unknown · Kashipara Music Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: An Incorrect Access Control issue was found in the "/music/ajax.php?action=delete playlist" endpoint. This issue allows an unauthenticated attacker to delete valid music playlist...

PT-2024-8660 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A flaw was found in Moodle related to insufficient access control when deleting OAuth2-linked accounts. This issue may allow a remote attacker to gain unauthorized access to limited...

PT-2024-5948

Name of the Vulnerable Software and Affected Versions Veeam ONE Agent affected versions not specified Description The issue concerns a flaw in access control within Veeam ONE Agent. Successful exploitation allows a remote attacker possessing the service account credentials for Veeam ONE Agent to...

PT-2024-8805 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A flaw was found in the dynamic tables of Moodle, where capability checks were not enforced, allowing users to retrieve information they did not have permission to access. This issue is...

PT-2024-7550 · Veeam · Veeam One

Name of the Vulnerable Software and Affected Versions: Veeam ONE affected versions not specified Description: The issue is related to an incorrect permission assignment, which allows an attacker to modify product configuration files. This is due to insufficient access control in the software...

PT-2024-10356 · Drupal · Drupal Paragraphs Table

Name of the Vulnerable Software and Affected Versions: Drupal Paragraphs table versions 0.0.0 through 1.22.0 Drupal Paragraphs table versions 2.0.0 through 2.0.1 Description: The issue is related to insufficient granularity of access control in Drupal Paragraphs table, which allows content...

Unauthorized Access

Umbraco CMS is vulnerable to unauthorized access. The vulnerability is due to insufficient access control mechanisms that fail to properly restrict access to certain endpoints based on user permissions, which allows to gain unauthorized information or performing actions outside their intended...

PT-2024-7252 · Скуд Gate · Скуд Gate

Name of the Vulnerable Software and Affected Versions: СКУД Gate affected versions not specified Description: The issue is related to insufficient access control in the СКУД Gate software. Exploitation of this issue may allow a remote attacker to gain access to the software's database...

PT-2024-41042 · Qtech · Qtech Gigabit Spf Wifi Gateway

Name of the Vulnerable Software and Affected Versions: Qtech Gigabit SPF WiFi Gateway affected versions not specified Description: The issue is related to insufficient access control in the Qtech Gigabit SPF WiFi Gateway's firmware, which can be exploited by a remote attacker to disclose protecte...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vu...

TVT DVR TD-2104TS-CL 和 TD-2108TS-HP 信息泄露漏洞

The TVT DVR TD-2104TS-CL and TVT DVR TD-2108TS-HP are both video recorders from China-based Tongwei TVT. An information disclosure vulnerability exists in the TVT DVR TD-2104TS-CL and TD-2108TS-HP that stems from insufficient access control and allows unauthorized disclosure of sensitive device...

PT-2024-5255 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to insufficient access control, allowing a remote attacker to disclose protected information. Recommendations: At the moment, there is no...

CVE-2020-11639 Insufficient access control on Inter process communication,

An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. T...

CVE-2020-11639 Insufficient access control on Inter process communication,

An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. T...

PT-2024-5836 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 7.0.0.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Analytics Web Answers component, allowing a low-privileged attacker with network...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the GET, PUT, DELETE /admins/adminId endpoints, allowing low privileged users to fetch, modify, or delete high privileged users admins, resulting in unauthorize...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the GET, PUT, DELETE /webhooks/webhookId endpoints, allowing low privileged users to fetch, modify, or delete webhooks of any user, resulting in unauthorized...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the POST /services endpoint, allowing low privileged users to create services for any user including admin, resulting in unauthorized data manipulation...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the GET, PUT, and DELETE endpoints for /services/serviceId, allowing low privileged users to fetch, modify, or delete services of any user, including admin...