Upgraded Q -> 2 from #345 [1699029532851]

Judge has assessed an item in Issue 345 as 2 risk. The relevant finding follows: Low-01 When a User-1 sell/transfer a safe to User-2, during transfer allowance is not clear in case of User-1 safeCan is a mapping which set allowance for other addresses, by which they can perform action on behalf o...

Atlassian’s Latest Critical Confluence Flaw Poses Risk of Data Loss

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical vulnerability identified in Atlassian as CVE-2023-22518 which pertains to be an improper authorization issue in Confluence Data Center and Server. If successfully exploited by an...

CloudExplorer Lite License Issue Vulnerability

CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box basic functionality for cloud hosting management, cloud billing, operational analytics, and security compliance, as well as powerful extensibility to meet the customization needs of enterprises. An authorization issue...

Jumpserver Authorization Issues Vulnerability

Jumpserver is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. JumpServer versions prior to 3.8.0 suffer from an authorization issue vulnerability that stems from an attacker being able to reset a password by sending an email...

LinkStack Authorization Issues Vulnerability

LinkStack is a unique platform from LinkStack Open Source that provides an efficient solution for managing and sharing links online. An authorization issue vulnerability exists in versions prior to LinkStack v4.2.9 that stems from the absence of a weak password recovery mechanism for forgotten...

Lenovo printers license issue vulnerability

Lenovo Printers is a printer from the Chinese company Lenovo. Lenovo Printers suffers from an authorization issue vulnerability that originates from a standard user being able to directly manipulate and set printer configuration information, such as the IP of certain Lenovo printers, without...

Alexander Maier EisBaer Scada Authorization Issue Vulnerability

Alexander Maier EisBaer Scada is a visual reality display and control program created on Windows operating systems by Alexander Maier of Germany. Alexander Maier EisBaer Scada suffers from an authorization issue vulnerability that arises from improper authorization...

PT-2023-29715 · Rumbletalk · Rumbletalk Live Group Chat

Name of the Vulnerable Software and Affected Versions: RumbleTalk Live Group Chat versions n/a through 6.2.5 Description: The issue is related to a missing authorization vulnerability in RumbleTalk Live Group Chat, which allows the exploitation of incorrectly configured access control security...

Adobe Commerce License Issue Vulnerability (CNVD-2023-82676)

Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. An authorization issue vulnerability previously existed in Adobe Commerce version 2.4.7, which stemmed from improper privilege management in the...

Webauthn-Framework Authorization Issues Vulnerability

Webauthn-Framework is an authentication mechanism. It is used by Web applications to create and use strong, proven, scoped, public-key based credentials for strong authentication of users. An authorization issue vulnerability exists in Webauthn-Framework that stems from improper handling of...

SAP S/4HANA Authorization Issues Vulnerability (CNVD-2024-10202)

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. An authorization issue vulnerability exists in SAP S/4HANA version 106, which can be exploited by an attacker to cause an escalation of privileges, due to a vulnerability...

CVE-2023-5521

Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9...

PT-2023-32151 · Tiann · Kernelsu

Name of the Vulnerable Software and Affected Versions: tiann/kernelsu versions prior to 0.6.9 Description: The issue concerns incorrect authorization in the tiann/kernelsu GitHub repository. This allows for root takeover via signature spoofing. Recommendations: For versions prior to 0.6.9, update...

Yifan YF325 Authorization Issues Vulnerability

Yifan YF325 is a wireless router from Yifan. An authorization issue vulnerability exists in Yifan YF325 v1.020221108. An attacker can exploit this vulnerability to execute arbitrary commands...

Huawei HarmonyOS and EMUI Licensing Issues Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. Huawei HarmonyOS and EMUI are vulnerable to an...

Uptime Kuma License Issue Vulnerability

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. An authorization issue vulnerability exists in Uptime Kuma versions prior to 1.23.3, which stems from a lack of session token validation after a password change or after a period of inactivity, and...

Information disclosure

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent Linux, macOS, Windows before build 36119...

PT-2023-29312 · Netis Systems · N3Mv2

Name of the Vulnerable Software and Affected Versions: NETIS SYSTEMS N3Mv2 version 1.0.1.865 Description: An issue in the authorization component of the HTTP request allows a remote attacker to cause a denial of service. Recommendations: For version 1.0.1.865, consider restricting access to the...

CVE-2023-4997

CVE-2023-4997 affects ProIntegra Uptime DC software prior to version 2.0.0.33940. The issue is improper authorization that allows regular users to change passwords of all accounts, including administrators, enabling privilege escalation. The CVE is documented with CVSS v3.1 signals: AV:N/AC:L/PR:...

Misskey Authorization Issues Vulnerabilities

Misskey is a suite of micro-blogging platforms. An authorization issue vulnerability exists in versions of Misskey prior to 2023.9.0 that stems from the ability to bypass authentication in the Bull dashboard...