36 matches found
MINI-P9WH-X2HM-7GXG
Bulletin has no description...
CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...
CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...
CVE-2026-66013
OpenRemote has a vulnerability (CVE-2026-66013) affecting versions before 1.26.2 where the console registration API is vulnerable to authentication bypass. This allows unauthenticated attackers to update existing console assets by supplying a known asset identifier, enabling them to overwrite pus...
EUVD-2026-46320
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned...
CVE-2026-55516
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/maintenanceid checks access to the current maintenance record and asset but then fills attacker-controlled fields including assetid without re-authorizing the newly supplied asset, allowing an...
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Summary A low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes or a preview redirect without enforcing a per-asset view authorization check, leading to potenti...
CGA-RX73-RR3H-9383
Bulletin has no description...
CVE-2021-32666
wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial of service between users. If a user has an invalid assetID for their profile picture and it contains the " character, it will cause the iO...
MS:A47C549D-4F54-48ED-BE10-98B85655B865
...
MS:60372B87-1B26-406B-AAD5-F42B49E24418
...
MS:ACF1E48A-5368-44FB-AD0C-A831E172134D
...
MS:BAC4F584-A642-446C-8720-A24C27D50C4B
...
MS:2F3485BC-E427-47CA-B1D7-CBC59469AE98
...
MS:11C0C141-11C8-4098-9252-BCAA9B17D2A5
...
MS:383FB305-E3D6-4163-827F-1691D47739A6
...
MS:F210AFA2-79F9-4C53-AA58-391A3B819131
...
MS:FB4BDD6B-7619-4D69-AF77-04FB4505D26F
...