CVE-2023-34163

Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2023-34159

Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, which affects availability and confidentiality...

CVE-2023-32677

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

Broken Access Control On Item via ID

Description By editing the ID on the request or HTML I can see some information of any item via ID Proof of Concept 1. Create two account with perrmission on two folder and set permission for each user. \ 2. Create item with each user \ 3. View detail a item and change itemid on request view...

CVE-2022-48360

The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality...

Design/Logic Flaw

The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2022-48360

CVE-2022-48360 concerns the facial recognition module, where a vulnerability in file permission control could lead to confidentiality exposure. The NVD entry lists a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no privileges required, and no user interacti...

PT-2023-15738 · Unknown · Facial Recognition Module

Name of the Vulnerable Software and Affected Versions: Facial recognition module affected versions not specified Description: The issue concerns a vulnerability in file permission control within the facial recognition module. This could potentially impact confidentiality if successfully exploited...

CVE-2023-22381 Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions

A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. To exploit this vulnerability, an attacker would need existing permission to...

Security Bulletin: The dasboard UI of IBM Sterling B2B Integrator is vulnerable to improper permission control (CVE-2022-40231)

Summary IBM Sterling B2B Integrator has addressed the improper permission control security vulnerability in the dashboard UI. Vulnerability Details CVEID:CVE-2022-40231 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow an authenticated user to perform unauthorized actions due ...

CVE-2022-40232

IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have access to due to improper permission controls. IBM X-Force ID: 235597...

Burn will not work if positions below to different owners

Lines of code Vulnerability details Impact When an option is created, the caller has an option of choosing any address to mint these three option positions to long0, long1, short or if the caller chooses the options can be added for the caller alone . The positons could be transferred through...

ASB-A-176094367

In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level 23 due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

Atlassian Bitbucket 8.1.x < 8.1.5 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Bitbucket 8.2.x < 8.2.4 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

CVE-2022-43781

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...

ZTE ZXvSTB License Issue Vulnerability

ZTE ZXvSTB is a cloud-enabled set-top box from China's ZTE. The ZTE ZXvSTB suffers from an authorization issue vulnerability that stems from improper privilege control, which can be exploited by an attacker to remove the default application type and affect the normal use of the system...

CVE-2022-23144

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system...

Improper access control

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system...

CVE-2022-23144

CVE-2022-23144 affects ZTE ZXvSTB. The vulnerability is described as broken access control due to improper permission control, enabling an attacker to delete the default application type and disrupt normal system use. CVSS v3.1 base score 9.1 (CRITICAL) with network attack vector, no user interac...