Dell EMC PowerStore 授权问题漏洞

Dell PowerStore all-flash data storage appliances use a data-centric, highly adaptable and intelligent infrastructure to deliver AppsON capabilities that enable the transformation of traditional and modern workloads.Dell PowerStore is vulnerable to an authorization issue that could be exploited b...

Schneider Electric Wiser Smart 授权问题漏洞

Schneider Electric Wiser Smart is a complete connected home solution from Schneider Electric, France. It brings comfort, convenience and security to the home. Schneider Electric Wiser Smart has an authorization issue vulnerability that stems from incorrect authentication...

PingCAP TiDB 授权问题漏洞

PingCAP TiDB is an open source, cloud-native, distributed, MySQL-compatible database for elastic scaling and real-time analytics from China-based PingCAP. PingCAP TiDB version 5.3.0 suffers from an authorization issue vulnerability, which stems from a problem with application rights management. A...

PT-2022-3034 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab Enterprise Edition versions 12.0 through 14.9.4 GitLab Enterprise Edition versions 14.10.0 through 14.10.3 GitLab Enterprise Edition versions 15.0.0 Description: The issue is related to incorrect authorization in GitLab Enterprise...

CVE-2022-26703

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.5 and iPadOS 15.5. A person with physical access to an iOS device may be able to access photos from the lock screen...

CVE-2022-26703

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.5 and iPadOS 15.5. A person with physical access to an iOS device may be able to access photos from the lock screen...

CVE-2022-26703

The CVE-2022-26703 entry concerns an authorization issue on iOS/iPadOS that could allow a person with physical access to an iPhone/iPad to view photos from the lock screen. The connected sources indicate this is addressed in iOS 15.5 and iPadOS 15.5 through improved state management. Affected com...

Apple macOS 授权问题漏洞

Apple macOS and others are products of Apple Inc. in the United States. apple macOS is a suite of specialized operating systems developed specifically for Mac computers. apple macOS Catalina is a suite of specialized operating systems developed specifically for Mac computers. apple macOS Big Sur ...

MantisBT Incorrect Authorization in bug_actiongroup_page.php

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

Online Sports Complex Booking System授权问题漏洞

Online Sports Complex Booking System is an online stadium booking system. version 1.0 of the Online Sports Complex Booking System is vulnerable to an authorization issue that could be exploited by attackers to take over a user's account via a specially crafted POST request...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

Zyxel USG/ZyWALL 授权问题漏洞

Zyxel USG/ZyWALL is a firewall from China's Heqin Technology Zyxel. An authorization issue vulnerability exists in Zyxel USG/ZyWALL versions 4.32-4.71, USG FLEX 4.50-5.21, ATP 4.32-5.21, and VPN 4.32-5.21, which stems from the lack of proper access control mechanisms and can be exploited to allow...

Airfield Online 授权问题漏洞

Airfield Online is an online store system from Airfield, Inc. Airfield Online suffers from an authorization issue vulnerability that could be exploited by an attacker to access sensitive data without proper authentication...

Apple tvOS licensing issue vulnerability

Apple tvOS is a smart TV operating system from Apple, Inc. Apple tvOS is vulnerable to an authorization issue stemming from improper AuthKit privilege management, which can be exploited by local attackers to bypass the authentication process...

DELL iDRAC9 授权问题漏洞

The Dell iDRAC9 is a Dell Inc. offering that provides comprehensive, embedded management, and automation capabilities across the PowerEdge family of servers. One Controller. An authorization issue vulnerability exists in Dell iDRAC9 that arises from improper privilege management and can be...

Cybozu Garoon Authorization Issue Vulnerability (CNVD-2022-53804)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an authorization issue vulnerability that originates from improper privilege managemen...

Cybozu Garoon Authorization Issue Vulnerability (CNVD-2022-54302)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an authorization issue vulnerability that originates from improper privilege managemen...

VMware Spring Security 授权问题漏洞

VMware Spring Security is a security framework from VMware that provides illustrative security protections for Spring-based applications. An authorization issue vulnerability exists in VMware Spring Security that stems from the use of RegexRequestMatcher and the wildcard . character of a regular...

Cybozu Garoon 安全漏洞

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an authorization issue vulnerability that originates from improper privilege managemen...

Cloud Foundry UAA accepts refresh token as access token on admin endpoints

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longe...