Soar Cloud HR Portal Authorization Issues Vulnerability

Soar Cloud HR Portal is a human resources application from Soar Cloud, Inc. Soar Cloud HR Portal suffers from an authorization issue vulnerability that stems from a weak password recovery mechanism for forgotten passwords, where an attacker with access to the browser history or with the line coul...

Tenda N300 Authorization Issues Vulnerability

Tenda N300 is a router from Tenda, a Chinese company. A security vulnerability exists in the Tenda N300 that originates from allowing unauthenticated page access...

CVE-2023-4346

KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this...

Moderate: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ASUSTOR Data Master 安全漏洞

ASUSTOR Data Master is a specialized operating system on ASUSTOR NAS from ASUS, China. An authorization issue vulnerability exists in ASUSTOR Data Master, which arises from improper privilege management and can be exploited by an unprivileged local attacker to modify the storage device...

Walchem Intuition 授权问题漏洞

Walchem Intuition is a controller from Walchem. An authorization issue vulnerability exists in Walchem Intuition 9 that stems from a lack of authentication for certain API routes that manage the web server...

Dell PowerScale OneFS 安全漏洞

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. Dell PowerScale OneFS suffers from an authorization issue vulnerability that stems from incorrect default permissions. An attacker could exploit this vulnerabilit...

PrivateUploader License Issue Vulnerability

PrivateUploader is the ultimate open source image uploader and file storage solution. An authorization issue vulnerability exists in versions prior to PrivateUploader 3.2.49, which stems from not properly validating whether a user is an administrator high level or a moderator low level, causing...

CVE-2023-38209

Adobe Commerce/Open Source Magento versions 2.4.4-p4–2.4.6-p1 (and earlier) are affected by an Incorrect Authorization vulnerability that permits a low-privileged attacker to access other users’ data without user interaction. The issue stems from improper access control and has a high confidentia...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation suffers from an authorization issue vulnerabili...

Pre-Auth SQLi leading to RCE in Social Media Skeleton v1.0

Summary A SQL Injection vulnerability exists in Social Media Skeleton v1.0 via the username and password parameters in admin/login.php. Not to be confused with login.php, which properly escapes special characters. Issue Description SQL injection SQLi is a code injection technique used to attack...

Insufficient Session Expiration

getkirby/cms is vulnerable to Insufficient Session Expiration. The vulnerability exists because web sessions are not properly expired which permits an attacker to reuse old session credentials or session IDs for authorization...

Authorization

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow...

CVE-2023-3442

CVE-2023-3442 affects the Jenkins Plug-in for ServiceNow DevOps prior to version 1.38.1. The issue is a missing authorization check that could allow exposure of sensitive information when exploited. The advisory explicitly recommends updating the plugin on Jenkins servers to 1.38.1; no changes ar...

CVE-2023-3442 Missing Authorization in Jenkins plug-in for ServiceNow DevOps

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow...

Authorization

Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push policies to unauthorized tenant group...

CVE-2023-32482

Dell Wyse Management Suite is affected by an improper authorization vulnerability (CVE-2023-32482) where an authenticated user with privileged access can push policies to unauthorized tenant groups. The CVE entry indicates affected software: Wyse Management Suite versions prior to 4.0; the CNVD/D...

Weintek Weincloud 授权问题漏洞

Weintek Weincloud is a cloud-based monitoring platform from Weintek, Inc. An authorization issue vulnerability exists in Weintek Weincloud version v0.13.6, which stems from a vulnerability that could allow an attacker to abuse the registration feature and log in to the official website using test...

Weintek Weincloud 授权问题漏洞

Weintek Weincloud is a cloud-based monitoring platform from Weintek, Inc. An authorization issue vulnerability exists in Weintek Weincloud version v0.13.6, which stems from a vulnerability that could allow an attacker to reset passwords using only the JWT token of the corresponding account...

Mattermost 授权问题漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from the fact that all previous tokens are not invalidated when a new reset token is created...