PT-2022-4041 · Jenkins · Jenkins Rpmsign-Plugin Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins rpmsign-plugin Plugin versions 0.5.0 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins rpmsign-plugin Plugin, allowing remote attackers with Item/Read permission but without...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-28749 Insufficient Authorization Check During Meeting Join

Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee. As a result, a threat actor in the Zooms waiting room can join the meeting without the consent of the host...

GHSA-PFXV-66R9-4GQW Magento Insufficient authorization check when adding users to company accounts

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing us...

Security Bulletin: IBM MQ Appliance could allow unauthorized viewing of logs and files (CVE-2022-22326)

Summary IBM MQ Appliance has resolved a vulnerability that could allow unauthorized viewing of logs and files. Vulnerability Details CVEID: CVE-2022-22326 DESCRIPTION: IBM MQ Appliance could allow unauthorized viewing of logs and files due to insufficient authorisation checks. CVSS Base score: 4...

IBM MQ Appliance 安全漏洞

IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM USA. A security vulnerability exists in IBM MQ Appliance that originates from a vulnerability that can be exploited by an attacker to read IBM MQ Appliance files via insufficient...

Cisco Small Business 缓冲区错误漏洞

Cisco Small Business is a switch from Cisco USA. A buffer error vulnerability exists in the Cisco Small Business RV Series Routers that results from an insufficient authorization enforcement mechanism. An attacker can exploit these vulnerabilities by submitting specific commands to the affected...

PT-2022-2298 · Cisco · Rv260 +4

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV Series Routers versions prior to the fixed version Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers affected versions not specified Description: The issue concerns a stack-based buffer overflow...

UBUNTU-CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

Authorization

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

CVE-2021-39341 OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

CVE-2021-34766

A vulnerability in the web UI of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the Syst...

Improper access control

A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this...

Authorization

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system. The vulnerability is due to insufficient authorization checking on an affected system. A...

Cisco IOS XE Software Web UI Authorization Bypass (cisco-sa-webui-auth-bypass-6j2BYUc7)

According to its self-reported version, Cisco IOS XE Software is affected by a Web UI authorization bypass vulnerability due to insufficient authorization of web UI access requests. An authenticated, remote attacker could exploit this vulnerability by sending a crafted HTTP request to the web UI....

IBM Data Risk Manager Elevation of Privilege Vulnerability

IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. An elevation of privilege vulnerability exists in IBM Data Risk Manager 2.0.6. The vulnerability stems from insufficient authorization checks. An attacker could exploit the...

CVE-2020-4621

IBM Data Risk Manager iDNA 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IBM X-Force ID: 184981...

CVE-2020-4621

IBM Data Risk Manager iDNA 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IBM X-Force ID: 184981...

CVE-2020-4621

CVE-2020-4621 affects IBM Data Risk Manager (iDNA) 2.0.6. An authenticated user could escalate privileges to administrator due to insufficient authorization checks. The IBM bulletin corroborates privileged actions and high-impact consequences. Mitigation: upgrade to 2.0.6.4 and apply subsequent f...

CVE-2020-3478 Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system...