Improper Access Control

gitlab:sid is vulnerable of improper access control. The vulnerability due to improper permission validation and fails to authorization check. It leads to allow an attacker to edit labels description by an unauthorized user...

Authorization

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed...

CVE-2023-50871

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed...

CVE-2023-50871

The CVE covers a vulnerability in JetBrains YouTrack: prior to 2023.3.22268, an authorization check for inline comments inside thread replies could be bypassed, exposing unauthorized access to sensitive inline-comment data. Affected software is JetBrains YouTrack (pre-2023.3.22268); root cause is...

JetBrains YouTrack Security Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2023.3.22268, which...

CVE-2020-10676

In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project...

CVE-2020-10676

In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project...

PT-2023-31124 · Peplink · Peplink Balance Two

Name of the Vulnerable Software and Affected Versions: Peplink Balance Two versions prior to 8.4.0 Description: A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication. This issue affects Peplink Balance Two and can be...

TextMe SMS < 1.9.1 - Subscriber+ Settings Update

Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

Duplicate Advisory: Apache Superset - Elevation of Privilege

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f678-j579-4xf5. This link is maintained to preserve external references. Original Description Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using th...

CVE-2023-40610

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

CVE-2023-40610

CVE-2023-40610 affects Apache Superset prior to version 2.1.2. The issue is an improper authorization check that enables privilege escalation when using the default examples database connection, which can grant access to both the examples schema and Superset metadata DB. A specially crafted CTE S...

Missing Authorization

rundeck is vulnerable to Missing Authorization. The vulnerability arises due to a missing authorization check for the https://host/context/rdJob/ and https://host/context/api//incubator/jobs endpoints. An attacker can view jobs names and groups for which they don't have authorization for...

The batchRefund function could benefit from access control checks, such as ensuring only authorized users can perform batch refunds.

Lines of code Vulnerability details M1 - The batchRefund function could benefit from access control checks, such as ensuring only authorized users can perform batch refunds. poc: solidity function batchRefund external onlyAuthorized returns Assessed type Access Control --- The text was updated...

Information Disclosure

org.wildfly.core: wildfly-controller is vulnerable to Information Disclosure. The vulnerability is caused by a missing authorization check in the resolve-expression HAL interface while reading a system property or environment variables. This can lead to a malicious user accessing the Wildfly syst...

CVE-2023-3998

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post...

Authorization

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post...

Authorization

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a comment...