CVE-2024-42327

CVE-2024-42327 / ZBX-25623에 대한 PoC 및 익스플로잇 Zabbix 프론트엔드에서 기본 User 역할 또는 API 액세스 권한을 부여하는 다른 역할을 가진 비관리자 사용자 계정이 이 취약점을 악용할 수 있습니다. CUser 클래스의 addRelatedObjects 함수에 SQLi가 존재하며, 이 함수는 API 액세스 권한이 있는 모든 사용자가 사용할 수 있는 CUser.get 함수에서 호출됩니다. 취약한 버전: 6.0.0 - 6.0.31, 6.4.0 - 6.4.16, 7.0.0 수정된 버전:...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler (versions 3.2.0 before 3.4.3 ) allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrators. The exposed kubeconfig data contains credentials that could permit unauthorized access to the Kubern...

CVE-2026-71895 Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

dir-3040_dos

dir-3040 서비스 거부 Dir-3060도 동일한 펌웨어에서 많은 구성 요소를 공유하므로 영향을 받을 수 있습니다. 최신 펌웨어 1.20b03a 핫픽스에서 테스트됨 기본적으로 FTP 서버 사용자 접근 페이지는 쓰기 권한이 있는 모든 사용자가 USB 드라이브로만 제한하는 대신 RAM에 직접 쓸 수 있도록 구성되어 있습니다. 이 문제에 대해 최신 펌웨어에는 경계 초과 또는 버퍼 오버플로 검사가 없습니다. 사용 가능한 메모리를 쓰기채우기한 후 시스템이 충돌하고 재부팅됩니다. 사용자는 공격을 수행하기 위해 관리자 권한이 필요하지...

CVE-2021-42562

CVE-2021-42562: MITRE Caldera における不適切なアクセス制御 Caldera バージョン =2.8.1 はユーザー権限を適切に分離しておらず、その結果、管理者以外のユーザーが管理者ユーザーのみがアクセスできるはずの設定やその他のコンポーネントを読み取り・変更できるようになっています。 ベンダー開示: この脆弱性に関するベンダーの開示はこちらで確認できます。 要件: この脆弱性には以下が必要です: 有効な非管理者ユーザーの資格情報 概念実証: 詳細と悪用プロセスは、このPDFに記載されています。 追加リソース:...

Astra Linux – Vulnerability in open-vm-tools

VMware Tools 12.0.0, 11.x.y, and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the guest OS can escalate privileges as a root user in the virtual machine...

EUVD-2026-77124

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-84989 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

PT-2026-85056

Name of the Vulnerable Software and Affected Versions ntopng versions 6.7.0 through 6.7.260717 Description Two REST v2 endpoints used to manage the tag/badge feature lack authorization checks. This allows any authenticated user, including those with unprivileged accounts, to delete or rename any...

CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-79747

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, is vulnerable to SSRF prior to version 1.0.32. An authenticated non-admin user can register a server pointing at an arbitrary URL, causing the hub to issue server-side requests with no egress filtering (loopback, R...

EUVD-2026-65700

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79665 Ech0 before 4.5.1 Authorization Bypass via Session Tokens

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...