168997 matches found
Concierge
Concierge Toolkit: Physical Access Control Identification and Exploitation The Concierge Toolkit is collection of various scripts and resources to aid the in identification and exploitation of physical access control and monitoring systems. Concierge currently contains tests and/or exploits for t...
NoFrak
NoFrak NoFrak is a Proof of Concept implementation for Android designed to prevent fracking attacks described in "Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks", by Martin Georgiev, Suman Jana, and Vitaly Shmatikov. NDSS 2014. Cordova Android Cordova...
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...
Atlassian Confluence - Privilege Escalation
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence. id: CVE-2023-22515 info: name: Atlassian Confluence - Privilege Escalation author:...
CVE-2026-58443
A flaw was found in Gitea. This vulnerability allows an attacker to use tokens intended for public repositories to modify private pull request PR branches. This could lead to unauthorized changes in private code, compromising the integrity of the affected repositories. Mitigation Update to Gitea...
CVE-2026-86271
A missing authorization vulnerability in FluentCMS up to 0.0.5 affects the GetAccessible function in src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs, allowing a remote attacker with existing authenticated access to bypass permission checks. The CVSS 3.1 base score is 4.7 (MEDIUM) ...
CVE-2026-71204-PoC
CVE-2026-71204 — changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement Product: dgtlmoon/changedetection.io — v0.55.7 Files: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — Improper Access Control CVSS 3.1:...
CVE-2026-54415-PoC
CVE-2026-54415 — Azuriom CMS Broken Access Control → Account Takeover Missing authorization on the admin server-management routes in Azuriom CMS 1.2.11 lets any low-privileged admin holding only admin.access mint an AzLink server token and take over any non-admin account...
PT-2026-86765
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type key data fingerprint but did n...
ROS-20260907-73-0529
The vulnerability in Java 1.8.0-openjdk is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...
PT-2026-86805
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
UBUNTU-CVE-2026-86091
ntopng before 6.7.260717 fails to check user privileges in the pools b...
PT-2026-86669
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...
ROS-20260907-73-0537
The vulnerability in Java-21-openjdk is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
ROS-20260907-73-0533
The vulnerability in Java-25-openJDK is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...
ROS-20260907-73-0532
The vulnerability in Java-21-openjdk is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
Linux Distros Unpatched Vulnerability : CVE-2026-76560
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty store...
PT-2026-86771
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide organisation index from users. As a result, authenticated users without the perm sharing group...