6772 matches found
CVE-2025-14881
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
EUVD-2025-204530
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
pretix has Broken Access Control Allowing Cross-User File Access via UUID
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
CVE-2025-14882
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
CVE-2025-14881
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
CVE-2025-14882 Insecure direct object reference
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
Apple macOS Tahoe Insufficient Privilege Restriction Vulnerability
Apple macOS Tahoe is a desktop operating system released by Apple on June 10, 2025, using the LiquidGlass design language and integrating several AI and cross-device features. Apple macOS Tahoe suffers from a permission restriction insufficiency vulnerability that stems from a flaw in the system'...
PT-2025-52444
Name of the Vulnerable Software and Affected Versions affected versions not specified Description Multiple API endpoints permitted access to sensitive files belonging to other users by utilizing the file's UUID. This unauthorized access occurred solely through knowledge of the UUID, bypassing...
PT-2025-51925
Name of the Vulnerable Software and Affected Versions DriveLock versions 24.1 through 24.1. DriveLock versions 24.2 through 24.2.7 DriveLock versions 25.1 through 25.1.5 Description The DriveLock agent creates directories and files with overly permissive Access Control Lists ACLs. This allows loc...
Honeywell Multiple Industrial Printers Improper Privilege Management (CVE-2017-5671)
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriti...
EUVD-2025-203395
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...
Apache Airflow exposes secret values to authenticated UI users via rendered templates
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this...
PYSEC-2025-86
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this...
CVE-2024-42197
HCL Workload Scheduler stores user credentials in plain text which can be read by a local user...
CVE-2025-13148 IBM Aspera Orchestrator Unverified Password Change
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password...
CVE-2024-42197 HCL Workload Scheduler is vulnerable to plain text storage of a password
HCL Workload Scheduler stores user credentials in plain text which can be read by a local user...
EUVD-2024-55325
HCL Workload Scheduler stores user credentials in plain text which can be read by a local user...