Siemens SICAM Q200 Privilege Escalation

The vulnerability of Siemens SICAM Q200 multifunctional measuring devices is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow a remote attacker to enhance their privileges...

GHSA-VH2G-6C4X-5HMP Path traversal and code execution via prototype vulnerability

Impact Due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. Patches Patched in v2.8.7...

Path traversal

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to...

CVE-2023-3322: Incorrect Permission Assignment for Critical Resource

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts...

Incorrect Permission Assignment

gitlab is vulnerable to Incorrect Permission Assignment. The vulnerability exists due to improper access control in the library, which allows an attacker to edit the approval rules via the API by an unauthorised user...

MariaDB Spider_db_mbase Print Warnings DoS

The vulnerability of the spiderdbmbase::printwarnings function in the MariaDB database is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to cause service failures...

WPE WebKit WebKitGTK Privilege Bypass

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to the improper assignment of privileges. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

DCMT Pointer Assignment DoS

The vulnerability of the library for working with the DICOM format in DCMT is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to trigger a service failure...

CVE-2023-3072: Incorrect Privilege Assignment

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

CVE-2023-3300: Incorrect Privilege Assignment

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised ...

GHSA-8RJH-3MHM-966Q Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised ...

GHSA-RF76-WHGP-FP56 Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong 1.7.0 o...

Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong 1.7.0 o...

Incorrect usage of Comparison Operator(==) instead of Asignment Operator(=) in PartnerManagerFactory

Lines of code Vulnerability details Impact The incorrect usage of comparison operator instead of an assignment operator in addPartner and addVault functions could lead to undesirable behaviour. While the mapping partnerIds and vaultIds are supposed to keep track of the IDs, due to the error, thes...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Incorrect Permission Assignment for Critical Resource (CVE-2018-1750)

Summary IBM Security Key Lifecycle Manager specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. In case of Windows operating system, all user accounts with access to the system will have read access to all the...

F5 Networks BIG-IP : iControl REST and tmsh vulnerability (K83284425)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.3 / 15.1.8.1 / 16.1.3.3 / 17.0.0.2 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K83284425 advisory. - In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before...

CVE-2023-3114: Incorrect Privilege Assignment

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the sa...

Juniper Networks Routing Protocol Demon DoS

The vulnerability of the Routing Protocol Data rpd in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to an unvalidated return value, which leads to the assignment of zero to certain variables. Exploiting this vulnerability can allow a attacker to cause service failur...

IBM Security Directory Suite VA Information Disclosure Vulnerability

IBM Security Directory Suite is a scalable, standards-based identity platform from International Business Machines IBM that simplifies identity and directory management. An information disclosure vulnerability exists in IBM Security Directory Suite VA, which could be exploited by an attacker to...