CVE-2024-2292

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

CVE-2024-44314

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

CVE-2024-9000

In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...

CVE-2024-2292

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

CVE-2024-11300

CVE-2024-11300 affects lunary-ai/lunary prior to version 1.6.3, via improper access control that lets a user view another user’s prompt data. The issue is triggered by accessing specific URLs (notably /prompts/prompt_id) and impacts 1.6.2 and the main branch. Documented characteristics: unauthori...

CVE-2024-2292

CVE-2024-2292 describes an access-control flaw that lets unauthorized users view and modify other users’ data. The primary sources agree on lack of proper access control as the root cause, with the NVD/Red Hat and related entries confirming this as the issue. The CVSS score is 7.1 (HIGH) with net...

CVE-2024-10274

CVE-2024-10274 affects lunary-ai/lunary v1.5.5. The /users/me/org endpoint is improperly accessible due to insufficient access control, enabling unauthorized users to view sensitive organization member data (names, roles, emails). The issue is documented with CVSS v3.0 base score 6.5 (Confidentia...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

GHSA-W5H7-MW56-4V7X TastyIgniter Has an Incorrect Access Control Vulnerability

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

CVE-2025-30111

On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication...

CVE-2025-30111

CVE-2025-30111 affects IROAD v9 dashcams. The issue arises from exposed endpoints that allow unauthorized users to list and download recorded videos and to access live video streams without proper authentication. Several sources (e.g., Red Hat advisory, NVD/NVD-linked entries, and CVE listings) d...

CVE-2024-44314

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

A flaw was found in Jetty's ThreadLimitHandler.getRemote. This flaw allows unauthorized users to cause remote denial of service DoS attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform v2.X. The vulnerability stems from improper access control, which allows unauthorized users to access and operate the management endpoints...

CVE-2024-57055

Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the necessary access level. This issue is limited to services used by the client not the general-use JSON services and requires reverse...

libcap 安全漏洞

libcap is a package of network data capture functions from the individual developer Michael Kerrisk. A security vulnerability exists in libcap, which stems from a parsing error in the pamcap.so group name, which can lead to elevation of privilege for unauthorized users...

Janto Ticketing 安全漏洞

Janto Ticketing is a ticketing software from Janto. A security vulnerability exists in versions of Janto Ticketing prior to r12, which stems from the presence of an unauthenticated password change feature that allows an unauthorized user to change another person's password...

CVE-2021-22509

A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1...

CVE-2022-1368

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an...

CVE-2020-28405

An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change the privileges of any user of the application. This can be used to grant himself the administrative role or remove all administrative accounts of the...