35 matches found
CVE-2021-25253
root@kitploit: Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 Trend Micro OfficeScan クライアント: バージョン = icacls "C:\Program Files x86\Trend Micro\OfficeScan...
KINGSOFT-WPS-Office-LPE
JVN アドバイザリ https://jvn.jp/en/vu/JVNVU90673830/ 以下のCVE番号が割り当てられています: CVE-2022-25943 KINGSOFT WPS Office LPE WPS Office は、珠海に本拠を置く中国のソフトウェア開発会社キングソフトが開発した、Microsoft Windows、macOS、Linux、iOS、Android、HarmonyOS向けのオフィススイートです。 WPSの調査...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell 修正 この PowerShell スクリプトは、CVE-2021-36934 を修正します。Joran Slingerland 氏のオリジナルスクリプトに基づいています https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 Powershell スクリプトは次の処理を行います: $env:windir\Logs\ の下に...
CVE-2020-10551
CVEID : CVE-2020-10551 影響を受ける製品とバージョン : QQBrowser（10.5.3870.400 より前のすべてのバージョン） 問題の種類 : CWE-284: 不適切なアクセス制御 概要 QQBrowserはTencentが開発したウェブブラウザです。中国で最も広く使われているウェブブラウザの一つです。テスト中に、特権を持たないローカル攻撃者がNT AUTHORITY\SYSTEMとしてコード実行を獲得できる脆弱性を発見しました。 10.5.3870.400...
CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
EUVD-2026-72322
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...
CVE-2026-52766
YesWiki (PHP-based wiki system) is vulnerable to unauthenticated arbitrary page deletion prior to version 4.6.6 . The {{erasespamedcomments}} action (actions/EraseSpamedCommentsAction.php) processes a suppr[] array from POST and deletes pages whose tags match, with no authorization check in the a...
CVE-2026-72840
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...
CVE-2026-72840
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...
Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET diagnostics IPC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A missing error check in .NET causes an...
CVE-2026-41115
A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMERGROUPDESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists ACLs,...
CVE-2026-41115
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
CVE-2026-41115
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
WordPress plugin Woocommerce Envato Affiliates 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
Linux Distros Unpatched Vulnerability : CVE-2026-24413
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set...
MiracleLinux 7 : pki-core-10.5.1-13.1.el7 (AXSA:2018-3231:02)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3231:02 advisory. pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access CVE-2018-1080 Tenable has extracted the preceding...
PT-2025-43771
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through = 3.5.3...