CVE-2022-34453: Improper Access Control

Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only user could potentially exploit this vulnerability to perform add/delete QoS policies which are disabled by default...

Atlassian Confluence 7.14.x < 7.19.9 Read Only User Attachment Uploads

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...

CVE-2023-20136

CVE-2023-20136 concerns a privilege-escalation in the OpenAPI of Cisco Secure Workload. An authenticated, read-only user with valid credentials could invoke OpenAPI calls that should require Administrator privileges, enabling actions such as creating/deleting user labels due to RBAC misconfigurat...

CVE-2023-20877

VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation...

PT-2023-2997 · Vmware · Vmware Aria Operations

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations affected versions not specified Description: The issue is related to insufficient access control in VMware Aria Operations, allowing a remote attacker to execute arbitrary code and escalate privileges. An authenticated...

Lenovo XClarity Controller 安全漏洞

Lenovo XClarity Controller XCC is a server-embedded management engine from Lenovo China that is used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller that originates from a valid XCC user with read-only privileges and...

SUSE CVE-2022-24805

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains...

CVE-2023-0444

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privilege...

CVE-2023-0444

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privilege...

Delta Electronics InfraSuite Device Master 安全漏洞

Delta Electronics InfraSuite Device Master is a device used to simplify and automate the monitoring of critical equipment from Delta Electronics Taiwan, China. A security vulnerability exists in Delta Electronics InfraSuite Device Master version 00.00.02a, which stems from the fact that the defau...

PT-2023-16275

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 00.00.02a Description A privilege escalation issue exists, allowing a lower-privileged user to view the password of a higher-privileged user. Specifically, the default user 'User' in the 'Read...

CVE-2022-38380

An improper access control CWE-284 vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API...

PT-2022-6667 · Cisco · Cisco Secure Workload

Name of the Vulnerable Software and Affected Versions: Cisco Secure Workload affected versions not specified Description: A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should...

CVE-2022-38743

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. ...

UBUNTU-CVE-2022-24805

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains...

CVE-2022-29271

In Nagios XI through 5.8.5, a read-only Nagios user due to an incorrect permission check is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks...

CVE-2022-29271

In Nagios XI through 5.8.5, a read-only Nagios user due to an incorrect permission check is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks...

Design/Logic Flaw

In Nagios XI through 5.8.5, a read-only Nagios user due to an incorrect permission check is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks...

CVE-2022-29271

In Nagios XI through 5.8.5, a read-only Nagios user due to an incorrect permission check is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks...

PT-2022-19513 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions 5.8.5 and earlier Description: The issue allows a read-only Nagios user to schedule downtime for any host or services due to an incorrect permission check. This enables an attacker to permanently disable all monitoring...