BigBlueButton 授权问题漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an authorization issue vulnerability that can be exploited by attackers to bypass access controls to access all breakout rooms of the conference they are in...

BigBlueButton 信息泄露漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an information disclosure vulnerability that stems from the lack of information protection measures and access controls for service meeting announcement chat messages.An attacker...

PT-2022-20466 · Bleve +1 · Bleve +1

Name of the Vulnerable Software and Affected Versions: Bleve affected versions not specified Description: The issue concerns the bleve/http package, which is used for demonstration purposes and lacks authentication, authorization, and validation of user inputs. This allows attackers to exploit a...

GHSA-5HCX-VG88-HGPM Magento 2 Community Edition Insufficient Access Controls

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes...

GHSA-C273-C6VG-4PV5 Publify has Improper Access Controls

A low-privileged user can modify and delete admin articles by changing the value of the articleid parameter prior to 9.2.9...

Publify has Improper Access Controls

A low-privileged user can modify and delete admin articles by changing the value of the articleid parameter prior to 9.2.9...

Easy authentication and authorization in Azure Active Directory with No-Code Datawiza

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. The acceleration of cloud journeys fueled by the pandemic and ever-increasing concerns about data security and information privacy have made access management one of the hottest topi...

CVE-2021-27444

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator...

CVE-2021-27444

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator...

CVE-2021-27444

The CVE-2021-27444 issue affects Weintek EasyWeb cMT product line, arising from improper access controls that allow an unauthenticated remote attacker to access sensitive data and perform administrative actions as a legitimate administrator. The CVE is documented with a high/critical impact (CVSS...

GHSA-CVVX-R33M-V7PQ Improper Input Validation in Apache Struts

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter...

GHSA-M643-2PFV-XWM8 Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API

A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API

A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

Borg Improper Access Control vulnerability

Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3...

You Can’t Eliminate Cyberattacks, So Focus on Reducing the Blast Radius

Lately, I’ve started wondering if the biggest risk concerning cyberattacks is that we’re becoming desensitized to them. After all, businesses experience a ransomware attack every 11 seconds—the majority of which the public never hears about. Faced with this reality, it may seem like your efforts ...

PT-2022-2593 · Microsoft · Windows Storage Spaces Direct +1

Name of the Vulnerable Software and Affected Versions: Windows Storage Spaces Direct affected versions not specified Description: The issue is related to insufficient access restrictions in the Storage Spaces Direct feature of Windows operating systems. This can be exploited to elevate privileges...

CVE-2021-29923

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

PT-2022-2974 · Microsoft · Windows Media Center +1

Name of the Vulnerable Software and Affected Versions: Windows Media Center affected versions not specified Description: The issue is related to insufficient access restrictions in Windows Media Center, allowing an attacker to elevate their privileges. There is no information provided about the...

CVE-2020-25160

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration...

CVE-2020-25160

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration...