Nadatel DVR Authorization Issues Vulnerability

Nadatel DVR is a series of hard disk recorders from the US company Nadatel. A security vulnerability exists in Nadatel DVR versions 3.0.0 through 9.9.0, which stems from an attacker being able to gain access to information through improper authentication...

Dell PowerEdge Server BIOS License Issue Vulnerability

Dell PowerEdge Server BIOS is a system update driver for the Dell Dell of the United States. The Dell PowerEdge Server BIOS has an authorization issue vulnerability that stems from the inclusion of incorrect privilege management, which can be exploited by an unauthenticated, local attacker to cau...

Huawei Smart Screen Authorization Issue Vulnerability

Huawei Smart Screen Huawei Smart Screen is China's Huawei Huawei equipped with a 120Hz high refresh rate screen and HarmonyOS system, providing the ultimate smooth sports experience and full-scene smart life. Huawei Smart Screen has an authorization issue vulnerability that can be exploited by...

Huawei HarmonyOS Multi-User Module Authorization Issue Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an authorization issue vulnerability that stems from improper privilege management in multi-user modules. An attacker could...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an authorization issue vulnerability that stems from an interface without privilege checks in the DFR module. An attacker could...

CVE-2023-47870

CVE-2023-47870 describes a CSRF/Missing Authorization flaw in wpForo Forum (WordPress plugin) versions up to 2.2.6, enabling CSRF and ACL-constraint bypass that can force logout of all users. Multiple sources identify wpForo as the affected product and indicate exploitation is not detailed in the...

Authorization

Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge...

CVE-2023-37890

CVE-2023-37890 affects KB Support – WordPress Help Desk and Knowledge Base (WordPress plugin) up to version 1.5.88. The issue is a Missing Authorization flaw that allows users with role as low as subscriber to view other customers’ data. Exploitation details are not provided in the initial docume...

ZITADEL Authorization Issues Vulnerability

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless in the Swiss ZITADEL open source. An authorization issue vulnerability exists in ZITADEL versions prior to 2.41.6, prior to 2.40.10, and prior to 2.39.9,...

Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An authorization issue vulnerability exists in Apache Superset versions prior to 2.1.2 that stems from the presence of incorrect authorization checks. An attacker could exploit this vulnerability...

CSZCMS License Issue Vulnerability

CSZCMS is an open source web application that allows managing all content and settings on a website. An authorization issue vulnerability exists in CSZCMS version 1.3.0, which stems from an unknown function in the file view template in the component File Manager Page, resulting in a permissions...

Ray Missing Authorization vulnerability

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...

Zoom Client Authorization Issues Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. An authorization issue vulnerability exists in Zoom Client that stems from improper authorization. An authorized user could be allowed to escalate privileges via web access...

GitLab 14.7 < 16.3.6 / 16.4.0 < 16.4.2 / 16.5.0 < 16.5.1 (CVE-2023-4700)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments,...

CVE-2023-42553

Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email...

Atlassian Confluence 8.x < 8.3.4 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.x prior 7.19.6, 8.x prior to 8.3.4, 8.4.x prior to 8.4.4, 8.5.x prior to 8.5.3 or 8.6.x prior to 8.6.1. It is, therefore, affected by an improper authorization vulnerability. Note...

Authorization

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

CVE-2023-5862 Missing Authorization in hamza417/inure

Missing Authorization in GitHub repository hamza417/inure prior to Build95...

WordPress Blog2Social Plugin < 6.9.12 Missing Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adenion:blog2social"; ifdescription...