CVE-2025-0652

CVE-2025-0652 affects GitLab EE/CE versions 16.9–17.7.6, 17.8.x prior to 17.8.5, and 17.9.x prior to 17.9.2. The issue enables unauthorized users to access confidential information intended for internal use. The published entries consistently describe this as an incorrect/unauthorized access auth...

CVE-2024-13703 CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level...

Philips IntelliSpace Perinatal 授权问题漏洞

Philips IntelliSpace Perinatal is an obstetric care information management solution for the healthcare industry from Philips of the Netherlands. An authorization issue vulnerability exists in Philips IntelliSpace Perinatal, which originates in the Windows logon process, where AuthContext tokens...

WordPress Awesome Import & Export plugin license issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

Schneider Electric EcoStruxure Power Automation System User Interface 授权问题漏洞

Schneider Electric EcoStruxure Power Automation System User Interface is a Schneider Electric user interface software for power automation systems from Schneider Electric France. It is used for operators to interact with the power automation system to improve operational efficiency. The Schneider...

CVE-2025-28938 WordPress WP Performance Pack plugin <= 2.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Performance Pack: from n/a through = 2.5.3...

PT-2025-10772

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 4.4.0 through 4.4.6 Description: An incorrect authorization issue may allow a low-privileged administrator to execute elevated CLI commands via the GUI console menu. This could potentially lead to privilege escalation...

SAP Business One 授权问题漏洞

SAP Business One is a suite of business management software from the German company SAP. The software includes functionality for financial management, operations management, and human resource management. SAP Business One suffers from an authorization issue vulnerability that stems from improper...

Ratify 授权问题漏洞

Ratify is an artifact approval framework CNCF sandbox from Ratify open source. An authorization issue vulnerability exists in Ratify version 1.2.3 and prior to version 1.3.2 that stems from the Azure Authentication Provider not verifying that the target registry is ACR, which could lead to misuse...

GHSA-6HRW-X7PR-4MP8 LF Edge eKuiper allows Stored XSS in Rules Functionality

Summary Stored Cross-Site Scripting XSS vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware,...

CVE-2025-2003

Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission...

CVE-2025-2003

Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission...

CVE-2025-2003

Devolutions Server versions 2024.3.12 and earlier are affected by a vulnerability involving incorrect authorization within PAM vaults . This flaw allows an authenticated user to bypass the 'add in root' permission , potentially enabling the execution of restricted actions. While the documents rec...

Linux Distros Unpatched Vulnerability : CVE-2022-23452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an...

Linux Distros Unpatched Vulnerability : CVE-2022-23451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or...

Faction 授权问题漏洞

Faction is an open source pen inspection report generation and evaluation collaboration framework from Faction Security. An authorization issue vulnerability exists in versions of Faction prior to 1.4.3, which stems from an attacker being able to register a new user with administrator privileges ...

Qualcomm Chipsets 授权问题漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. An authorization issue vulnerability exists in Qualcomm Chipsets that stems from information disclosure during session key derivation...

Qualcomm Chipsets 授权问题漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. An authorization issue vulnerability exists in Qualcomm Chipsets that stems from improper authentication and could lead to information disclosure...

WSO2 incorrect authorization vulnerability

An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potential...

Mastodon 授权问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. An authorization issue vulnerability exists in Mastodon that stems from an unapproved user being able to view the reason for a domain block, affecting instance administrators who do not wish to make...