The vulnerability of SAP Document Builder in creating and managing documents, related to deficiencies in the authorization process, allows attackers to escalate their privileges.

The vulnerability of SAP Document Builder, a tool for creating and managing documents, is related to deficiencies in its authentication procedures. Exploiting this vulnerability could allow attackers to gain increased privileges remotely...

PT-2025-4624 · Unknown · Cf7 Google Sheets Connector

Name of the Vulnerable Software and Affected Versions: CF7 Google Sheets Connector versions n/a through 5.0.17 Description: The issue is related to a lack of authorization in GSheetConnector CF7 Google Sheets Connector, which allows exploiting incorrectly configured access control security levels...

The vulnerability of the implementation of the authorization mechanism for microprogramming software in Moxa EDS-508A switches allows a intruder to gain unauthorized access to the device’s configuration files.

The vulnerability of the authentication mechanism for Microprogramming Software on Moxa EDS-508A switches lies in the exploitation of vulnerabilities in the identification/authentication mechanism. Exploiting this vulnerability can allow an intruder, operating remotely, to gain unauthorized acces...

CVE-2024-42000 Unauthorized Access to view channels' details

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 and 10.0.x = 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that...

The vulnerability of the Compensation Plan component of Oracle Incentive Compensation system for corporate clients allows a violator to gain access to modify, add, and delete data. This component is part of the Oracle E-Business Suite, which automates business operations.

The vulnerability of the Compensation Plan component of Oracle’s corporate client incentive compensation system, Oracle Incentive Compensation OIC, and the Oracle E-Business Suite automation system, is related to deficiencies in the authorization process due to incorrect validation of input data...

ROS-20240424-02

A vulnerability in the Libraries component of the Oracle Java SE software platform and Oracle GraalVM virtual machine. Enterprise Edition is related to a flaw in the authorization procedure. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected informatio...

PT-2024-5973 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.6 through 17.0.5 GitLab CE/EE versions 17.1 through 17.1.3 GitLab CE/EE versions 17.2 through 17.2.1 Description: An issue in GitLab CE/EE allows disclosure of limited information of an exported group or project to...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment, related to deficiencies in authorization procedures, allows unauthorized users to gain access to protected information.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in authorization procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Understanding the OWASP API Security Top 10: Why BOLA is the Number One Risk for APIs

Understanding and addressing vulnerabilities is critical in cybersecurity, where APIs serve as the backbone for seamless data exchange. The OWASP API Security Top 10, revised in 2023, provides a comprehensive guide to the critical issues that organizations must tackle to ensure the robust securit...

PT-2023-9573 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to weaknesses in the authorization mechanism of the Common Components component in Oracle Financials, part of the Oracle E-Business Suite. This can allo...

PT-2023-30739 · Rundeck · Rundeck

Name of the Vulnerable Software and Affected Versions: Rundeck versions 4.12.0 through 4.16.0 Description: The issue allows authenticated users to access certain URL paths without necessary authorization checks, potentially enabling them to view or delete jobs. The affected URLs are:...

CVE-2022-45172

An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected ...

PT-2022-16014 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 14.2.99.148 Tuleap Community Edition version 14.2.99.148 Tuleap Enterprise Edition version 14.2-5 Tuleap Enterprise Edition version 14.1-6 Description: Tuleap is an Open Source Suite to improve management of software...

The vulnerability of Websoft HCM’s automation software for HR processes stems from deficiencies in the authorization process, allowing unauthorized individuals to gain access to protected information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2022-4419 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in the Windows Hyper-V system, which is caused by flaws in the authorization procedure. This vulnerability can be...

Huawei EMUI和Huawei Magic UI 安全漏洞

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI Nearby modules are vulnerable to authorization issues that could be exploited by attackers to compromise availability and integrity...

Easytest 安全漏洞

Easytest is an online learning quiz platform of China's Huaju Digital Technology, Inc. Easytest is vulnerable to authorization issues, which can be exploited by remote attackers to access user and administrator account information other than passwords by constructing URL parameters after gaining...

Cobbler 安全漏洞

Cobbler is a Linux installation server that allows for quick setup of network installation environments.Cobbler is vulnerable to authorization issues in versions prior to 3.3.0.The vulnerability stems from a lack of authentication measures or insufficient authentication strength in the network...

PT-2021-4347 · Sap · Sap Netweaver Application Server Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java JMS Connector Service versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description: The issue is related to the JMS Connector Service in SAP NetWeaver Java Application Server, where there are shortcomings in t...

MIK.starlight 授权问题漏洞

MIK.starlight is the departmental access and creation dashboard, reporting and planning environment. MIK.starlight is vulnerable to authorization issues, which could allow an attacker to escalate privileges through the vulnerability...