PT-2023-20624 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Attackers can request arbitrary snippet IDs, including E-Mail signatures of other users within the same context, even if they are not explicitly shared...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization checks. A low-privileged attacker can modify minor functionalities of another user's data without requiring user...

PT-2023-12045 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier Description: The issue is related to improper access control, allowing attackers to validate online payments using a tokenized payment method belonging to...

CVE-2022-33959

IBM Sterling Order Management 10.0 could allow a user to bypass validation and perform unauthorized actions on behalf of other users. IBM X-Force ID: 229320...

CVE-2023-24834 WisdomGarden Tronclass ilearn - Broken Access Control

WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL...

HGiga MailSherlock 安全漏洞

Hgiga MailSherlock is an enterprise mail auditing system from China Henderson Technology Hgiga. A security vulnerability exists in HGiga MailSherlock version 4.5, which stems from an insufficient access control issue. The vulnerability can be exploited by an attacker to access parts of other user...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google. Google Pixel suffers from a security vulnerability that stems from a lack of permission checking, which could allow users to change other users' Wi-Fi settings...

CVE-2023-0865

The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to...

WordPress Plugin WooCommerce Multiple Customer Addresses & Shipping 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

SUSE CVE-2006-4019

Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users...

SUSE CVE-2009-3289

The gfilecopy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link 777, which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory...

SUSE CVE-2017-0936

Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could...

SUSE CVE-2017-8440

Starting in version 5.3.0, Kibana had a cross-site scripting XSS vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

SUSE CVE-2023-0241

pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database...

CVE-2023-23851

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files including web pages without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the...

wallabag 授权问题漏洞

wallabag is a web application that allows you to save web pages for later reading. wallabag versions prior to 2.5.3 contain an authorization issue vulnerability that stems from the fact that the exporting entry module is vulnerable to an IDOR attack, which could be exploited to view other users'...

CVE-2023-24058

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservationsave.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler Sep 6, 2022 Feature...

PT-2023-18523 · Nextcloud · Nextcloud Deck

Name of the Vulnerable Software and Affected Versions: Nextcloud Deck app versions prior to 1.6.5 Nextcloud Deck app versions prior to 1.7.3 Nextcloud Deck app versions prior to 1.8.2 Description: The issue is related to broken access control, allowing a user to delete attachments of other users...

CVE-2022-4861

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource...

PT-2022-22999 · Miele · Appwash Mobileapp

Name of the Vulnerable Software and Affected Versions: Miele AppWash MobileApp affected versions not specified Description: The issue concerns an API endpoint used by Miele's AppWash MobileApp, which was vulnerable to an authorization bypass. A low-privileged, remote attacker could gain read and...