1548 matches found
CVE-2022-31155: Incorrect Authorization
Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only...
CVE-2022-0594 Shareaholic < 9.7.6 - Information Disclosure
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated in v 9.7.5 and author+ in v9.7.5 users, allowing them to call it and retrieve various information such as t...
CVE-2022-31168
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
CVE-2022-31168
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
PT-2022-20582
Name of the Vulnerable Software and Affected Versions Zulip Server versions 5.4 and earlier Description The issue arises from an incorrect authorization check in Zulip Server, allowing a member of an organization to craft an API call that grants organization administrator privileges to one of the...
Zulip 安全漏洞
Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in Zulip Server version 5.4 and earlier versions, which stems from an incorre...
The auction doesn't check who puts a vault up for auction and can lead to a denial of service attack, and other actions beneficiary an attacker
Lines of code Vulnerability details Impact The permission for whoever can set an undercollaterized vault up for auction is not checked, an arbitrary user can set any vault for auction, set themselves up as the auctioneer and also get the reward. The real owners of the vault wont be able to their...
CVE-2021-34538 Apache Hive Security vulnerability in Hive with UDFs
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...
Authorization
Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to...
RCE due to Improper Authorization in 'Add Extension' functionality
Description The application does not properly implement authorization checks in the add extension functionality and allows a low-privileged user to upload extensions. Since no approval/verification is required to create an account in the application, any unauthenticated attacker can create a...
CVE-2022-20736
A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This...
CVE-2022-31589
CVE-2022-31589 impact details from a PT-Security note describe an improper authorization check affecting the SHAAM program’s Israeli File usage, specifically the /ATL/VQ23 transaction (API Endpoint). This can grant business users more than requested permissions, potentially allowing access to dat...
CVE-2022-1777
CVE-2022-1777 affects the WordPress Filr plugin (prior to 1.2.2.1). Two AJAX actions (upload_file, delete_file) lack proper authorization checks; nonce-based protection is exposed via dashboard, enabling any authenticated user (e.g., subscriber) to upload arbitrary HTML files and delete files. Re...
CVE-2022-1589
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...
ChromeOS usbguard Bypass
ChromeOS' usage of usbguard is bypassable VULNERABILITY DETAILS ChromeOS uses https://usbguard.github.io/ when the screen is locked but not on the login screen, perhaps because it is expected that code execution is much less helpful when the disk is still encrypted?. When the screen is locked, a...
CVE-2022-29611: Missing Authorization
SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...
CVE-2021-25002
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL...
Code injection
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL...