2579 matches found
CVE-2024-55991
CVE-2024-55991 affects the WordPress plugin WP-CRM System (versions up to 3.2.9.1). The root cause is a Missing Authorization vulnerability due to incorrectly configured access control, enabling unauthorized access. Documented details indicate Broken Access Control as the weakness, impacting WP-C...
CVE-2024-56227 WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Royal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1001...
CVE-2024-56215
CVE-2024-56215 concerns the WordPress plugin “Member Directory and Contact Form” (Stephen Sherrard) with versions ≤ 1.7.0. The vulnerability is a missing/incorrect authorization control (broken access control) that enables exploitation due to improperly configured access levels. Impact is describ...
PT-2024-36745 · Deluxethemes · Userpro
Name of the Vulnerable Software and Affected Versions: Userpro versions up to 5.1.9 Description: The issue is related to a missing authorization vulnerability in DeluxeThemes Userpro. This problem allows unauthorized access due to the lack of proper authorization checks. Recommendations: For...
GHSA-7RM3-4W6J-8XX4 TeamPass mail_me operation authorization issue
TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...
CVE-2024-50702
TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...
OpenCTI 授权问题漏洞
OpenCTI is an open source cyber threat intelligence platform from OpenCTI Open Source. An authorization issue vulnerability exists in OpenCTI version 6.2.18 and earlier, which stems from insufficient access control to support information, allowing a normal user to access information that is...
Discourse authorization issue vulnerability (CNVD-2024-4964085)
Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse has an authorization issue vulnerability that stems from improper privilege management of the Filter Email List feature in the...
Socialstream 授权问题漏洞
Socialstream is a third-party package for Laravel Jetstream by Joel Butcher, an individual developer. An authorization issue vulnerability exists in versions of Socialstream prior to 6.2.0, which stems from a lack of a validation step when associating a social account with an authenticated user,...
SAP HCM Approve Timesheets Authorization Issues Vulnerability
SAP HCM Approve Timesheets is a transactional application from SAP, Germany. An authorization issue vulnerability exists in SAP HCM Approve Timesheets version 4, which stems from a failure to perform the required authorization checks on authenticated users and can be exploited by an attacker to...
Microsoft Windows Defender Authorization Issues Vulnerability
Microsoft Windows Defender is a suite of antivirus software that comes with Windows systems from the American company Microsoft. Microsoft Windows Defender suffers from an authorization issue vulnerability that arises from improper authorization of an index containing sensitive information in a...
WordPress plugin Biagiotti Membership 授权问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. An authorization issue...
CVE-2024-12539 Elasticsearch Incorrect Authorization
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow...
CVE-2024-12539 Elasticsearch Incorrect Authorization
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow...
CVE-2024-54125
Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...
CVE-2024-56003
CVE-2024-56003 is a Missing Authorization vulnerability in Caldera SMTP Mailer. The Red Hat entry and the CVE description indicate impact on Caldera SMTP Mailer versions from unspecified earlier releases up to 1.0.1, with the issue originating from missing authorization. No exploitation details a...
CVE-2024-55999 WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilanguage Sitemap Generator: from n/a through = 2.0.6...
CVE-2024-55994
CVE-2024-55994 describes a Missing Authorization vulnerability in the 畅言评论系统 (Changyan commenting system). The entry states an access-control misconfiguration affects 畯畅言评论系统: from n/a through 2.0.5, enabling unauthorized actions due to incorrectly configured security levels. The CVSS base score ...
CVE-2024-56007 WordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in leader codes Leader leader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leader: from n/a through = 2.6.1...