Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8, which stems from improper privilege management in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc...

PT-2024-19182 · Zte · Zte Zxr10 3800-8 +3

Name of the Vulnerable Software and Affected Versions: ZTE ZXR10 1800-2S series versions V4.00.10 and earlier ZTE ZXR10 2800-4 versions V4.00.10 and earlier ZTE ZXR10 3800-8 versions V4.00.10 and earlier ZTE ZXR10 160 series versions V4.00.10 and earlier Description: The issue is related to...

PT-2024-38043 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui version v0.3.8 Description: The issue is related to improper privilege management in the API endpoints "GET /api/v1/documents/" and "POST /rag/api/v1/doc". This allows a lower-privileged user to access and overwrite files managed b...

The vulnerability of the RunJar.run() function on the distributed development and execution platform for Apache Hadoop allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the RunJar.run function on the distributed development and execution platform for Apache Hadoop is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2024-8099 · Schneider Electric · Easergy Studio

Name of the Vulnerable Software and Affected Versions: Easergy Studio affected versions not specified Description: The issue is related to improper privilege management, which could allow an unauthorized user to gain access, causing loss of confidentiality, integrity, and availability of the...

PT-2025-11524 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to Improper Privilege Management, which could be exploited by a low-privileged attacker with local access, potentially leading to unauthorized...

The vulnerability of the PAM authentication mechanism for Authd in Ubuntu operating systems allows a hacker to gain access to another user’s account.

The vulnerability of the PAM authentication mechanism for Authd in Ubuntu operating systems is related to errors in privilege management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to another user’s account by executing commands like “su”, “sudo”...

The vulnerabilities in the software for creating and managing graphical user interfaces on Rockwell Automation’s 2800C OptixPanel Compact, 2800S OptixPanel Standard, and Embedded Edge Compute Module – the computing module for supporting production automation software infrastructure – allow attackers to obtain user credentials and enhance their privileges.

The vulnerability of software tools for creating and managing graphical user interfaces on Rockwell Automation’s 2800C OptixPanel Compact, 2800S OptixPanel Standard, and Embedded Edge Compute Module devices relates to insecure privilege management. Exploiting this vulnerability can allow an...

The vulnerability of the openshift4/ose-docker-builder component of the Red Hat OpenShift Container Platform allows a attacker to enhance their privileges on the node where containers are executed.

The vulnerability of the openshift4/ose-docker-builder component of the Red Hat OpenShift Container Platform is related to errors in privilege management. This allows a malicious actor to escalate their privileges on the node where containers are executed...

PT-2024-39656 · Unknown · Upkeeper Instant Privilege Access

Name of the Vulnerable Software and Affected Versions: upKeeper Instant Privilege Access versions prior to 1.2 Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in upKeeper Instant Privilege Access. Recommendations: For versions prior to 1.2, update...

The vulnerability of the Rockwell Automation Pavilion8 platform for simulation, control, and optimization, related to insecure privilege management, allows a intruder to gain unauthorized access to arbitrary functions.

The vulnerability of the Rockwell Automation Pavilion8 platform for simulation, control, and optimization is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to gain unauthorized access to arbitrary functions...

The vulnerability of the Blink web browser component in Google Chrome allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the Blink web browser component in Google Chrome is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service interruptions through a specially creat...

Improper Privilege Management

org.apache.hadoop,hadoop-common is vulnerable to Improper Privilege Managements. The vulnerability is due to the RunJar.run method not setting permissions for the temporary directory by default, which allows other local users to view sensitive data stored in that directory...

CVE-2024-45373 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege Management

Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator...

Exploit for Improper Privilege Management in Oracle Vm_Virtualbox

cve-2023-21987-poc Oracle VirtualBox VGA OOB-Read Vulnerab...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION : Exploitable remotely/low attack complexity Vendor : Dover Fueling Solutions DFS Equipment : ProGauge MAGLINK LX CONSOLE Vulnerabilities : Command Injection, Improper Privilege Management, Use of Hard-coded Password, Cross-site Scripting,...

The vulnerability in the Linux kernel driver for microprogrammed network controllers and adapters of Intel Ethernet allows a hacker to exploit their privileges.

The vulnerability in the Linux kernel driver for microprogrammed network controllers and adapters of Intel Ethernet is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to enhance their privileges...

CVE-2024-8263

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. Thi...

CVE-2024-8263

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. Thi...

CVE-2024-8263

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. Thi...