UBUNTU-CVE-2021-39883

Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. An authorization issue vulnerability exists in GitLab EE, which can be exploit...

CVE-2021-24633

The CVE concerns the Countdown Block WordPress plugin (versions before 1.1.2). The issue is missing authorization in the eb_write_block_css AJAX action, enabling any authenticated user (e.g., Subscriber) to modify post contents displayed to users, impacting integrity of content. The root cause is...

Teleport authorization issue vulnerability

Teleport is an identity-aware, multi-protocol access agent from Teleport USA, Inc. Used by engineers and security professionals to unify access to SSH servers, Kubernetes clusters, web applications, and databases across all environments, Teleport suffers from an authorization issue vulnerability...

VMware vCenter Server Licensing Issue Vulnerability (CNVD-2021-74278)

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructure. vmware vCenter Server is vulnerab...

VMware vCenter Server Licensing Issue Vulnerability

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructure. vmware vCenter Server is vulnerab...

JetBrains Hub Licensing Issue Vulnerability (CNVD-2022-09222)

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is able to integrate multiple JetBrains team tools together.JetBrains Hub versions prior to 2021.1.13389 have an authorization issue vulnerability that can be exploited by an attacker to cause an account to be...

Cisco SD-WAN vManage Software 授权问题漏洞

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco. An authorization issue vulnerability exists in Cisco SD-WAN vManage Software, which stems from a lack of authentication of the user's identity in the product's disaster...

Multiple NETGEAR Switches Vulnerable to Licensing Issues

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. A variety of NETGEAR switches are vulnerable to an authorization issue, which stems from a password field in the product's Web UI that fails to properly hand...

Apple iOS/macOS 授权问题漏洞

Apple iOS is a set of operating systems developed by Apple Inc. for mobile devices. Apple iOS/macOS suffers from an authorization issue vulnerability that stems from improper execution of the Siri lock screen. The vulnerability can be exploited by an attacker to view contacts via the lock screen...

Teleport授权问题漏洞

Teleport is an identity-aware, multi-protocol access agent from Teleport USA, Inc. Used by engineers and security professionals to unify access to SSH servers, Kubernetes clusters, web applications, and databases across all environments, Teleport suffers from an authorization issue vulnerability...

Xiaomi community licensing issue vulnerability

Xiaomi Community, an official user community application of Xiaomi, China, is vulnerable to an authorization issue in versions prior to 3.0.210809, which stems from the exposure of some js interfaces. An attacker could use this vulnerability to maliciously invoke sensitive functions...

XssHunter-Express 授权问题漏洞

XssHunter-Express is used to test and find blind XSS. XssHunter-Express suffers from an Authorization Problem vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Apache Shiro 授权问题漏洞

Apache Shiro is a powerful and easy-to-use Java security framework with features including authentication, authorization, encryption and session management.APACHE SHIRO authentication bypass vulnerability can be exploited by attackers to construct specific HTTP requests to bypass authentication a...

NETGEAR 注入漏洞

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. A variety of NETGEAR switches are vulnerable to an authorization issue, which stems from a password field in the product's Web UI that fails to properly hand...

Jitsi Meet 授权问题漏洞

Jitsi Meet is is a set of open source projects. Enabling users to use and deploy a video conferencing platform with state-of-the-art video quality and features. A vulnerability in authorization issues exists in versions prior to Jitsi Meet 2.0.5963, which stems from the Prosody module allowing th...

SAP NetWeaver Application Server Java 授权问题漏洞

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used for developing and running Java EE applications. An authorization issue vulnerability exists in SAP NetWeaver Application Server Java version...

Microsoft Azure 授权问题漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. An authorization issue vulnerability exists in Microsoft Azure Open Management Infrastructure. The following products and versions are affected: Azure Open Management Infrastructure...

CVE-2021-39206

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect...

Arista Networks MOS 授权问题漏洞

Arista Networks MOS is a fully programmable and highly modular Linux-based network operating system from Arista Networks, Inc. that uses the familiar industry-standard CLI and runs a single binary software image in the Arista switch family.Arista Networks MOS is vulnerable to an authorization...