CVE-2021-41032

An improper access control vulnerability CWE-284 in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...

CVE-2025-23203

Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required...

CVE-2025-23203

CVE-2025-23203 affects Icinga Director (REST API) prior to versions 1.10.4 and 1.11.4. An authenticated Director user with API access can retrieve or modify information for objects they should not fully access, via endpoints such as icingaweb2/director/service (host omitted), icingaweb2/director/...

Linux Distros Unpatched Vulnerability : CVE-2024-22116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping fo...

CVE-2024-7724

Summary: CVE-2024-7724 is a Foxit PDF Reader/Editor use-after-free vulnerability in AcroForm handling that can lead to remote code execution. The exploit requires user interaction (the target must open a malicious file or visit a malicious page). Affects: Foxit PDF Reader/Editor (various versions...

PT-2023-25395 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 14.9.99.63 Description: The issue occurs when switching from a project visibility that allows restricted users to Private without restricted, where restricted users that are project administrators retain their access...

CVE-2023-1109: Improper Limitation of a Pathname to a Restricted Directory

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the...

PT-2023-20051 · Aten · Aten Pe8108

Name of the Vulnerable Software and Affected Versions: Aten PE8108 version 2.4.232 Description: The issue concerns Incorrect Access Control, where restricted users have access to other users' outlets. Recommendations: For Aten PE8108 version 2.4.232, consider restricting access to outlet controls...

CVE-2023-25409

Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets...

CVE-2023-25409: Exposure of Resource to Wrong Sphere

Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets...

CVE-2023-28336

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access...

PT-2023-17110 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2022.3.13 and prior Description: The issue allows users with restricted rights to bypass entry permission via id collision when importing or synchronizing entries in the User vault. Recommendations: For Devolutions...

K68785753: ImageMagick vulnerability CVE-2015-8898

Security Advisory Description The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted image file. CVE-2015-8898 Impact BIG-IP systems that use a WebAcceleration profile configured wit...

FortiADC -- Read-Only user able to modify system files

An improper privilege management vulnerability CWE-269 in FortiADC may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access...

PT-2022-11771 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 6.2.1 and below FortiADC versions 6.1.5 and below FortiADC versions 6.0.4 and below FortiADC versions 5.4.5 and below FortiADC versions 5.3.7 and below Description: An improper privilege management issue may allow a remote...

CVE-2022-23442

An improper access control vulnerability CWE-284 in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands...

CVE-2022-23442

An improper access control vulnerability CWE-284 in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands...

CVE-2021-41032

An improper access control vulnerability CWE-284 in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...

Fortinet FortiOS 安全漏洞

Fortinet FortiOS is a dedicated security operating system for the FortiGate network security platform from Fortinet, Inc. Fortinet FortiOS versions 6.4.8 and earlier and 7.0.3 and earlier are vulnerable to an access control error that could be exploited by an authenticated attacker with a...

CVE-2021-26107

An improper access control vulnerability CWE-284 in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager...