Authorization

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only...

Bytebase 授权问题漏洞

Bytebase is Bytebase's open source web-based, zero-configuration, dependency-free database schema change and version control management tool for DevOps teams. projects", which can be exploited by an attacker to view "projects" created by "Admin"...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix Javascript SDK prior to version 19.7.0, which stems from matrix-js-sdk implementing an overly lax key forwarding policy on the receiving end...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix Javascript SDK prior to version 19.7.0, which stems from a lack of required checks in matrix-js-sdk...

PT-2022-24826 · Unknown · Fhir-Works-On-Aws-Authz-Smart

Name of the Vulnerable Software and Affected Versions: fhir-works-on-aws-authz-smart versions 3.1.1 through 3.1.2 Description: The issue allows a client of the API to retrieve more information than the client's OAuth scope permits when making "search-type" requests. However, this issue would not...

Ericsson Erlang 授权问题漏洞

Ericsson Erlang is a general-purpose concurrency-oriented programming language from Ericsson, Sweden. A security vulnerability exists in Erlang versions prior to 23.3.4.15, 24.x up to 24.3.4.2, and 25.x up to 25.0.2, which stems from bypassing client authentication in certain client-side...

Trend Micro Apex One 授权问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro, Inc. A security vulnerability exists in Trend Micro Apex One version 2024 On-prem SaaS, which stems from the fact that if a remote attacker sends a specially crafted request to the affected product, it could bypass the...

CVE-2022-31247 Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings such as cluster-owner, manage cluster members, project-owner and manage project members to gain owner permission in another...

Apache IoTDB 授权问题漏洞

Apache IoTDB is an integrated data management engine designed for time-series data from the Apache Foundation that provides data collection, storage, and analysis services, etc. An authorization issue vulnerability exists in Apache IoTDB version 0.13.0, which stems from vulnerability to session i...

SFTPGo 授权问题漏洞

SFTPGo is a full-featured and highly configurable SFTP server by Nicola Murino, a personal developer in Italy. An authorization issue vulnerability exists in SFTPGo versions 2.2.0 through 2.3.3, which stems from the fact that TOTP is typically configured on mobile devices that may be lost, stolen...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab. An attacker exploited the...

Aruba AOS-CX 授权问题漏洞

Aruba AOS-CX is a modern programmable network from Aruba, USA. A security vulnerability exists in the Aruba AOS-CX, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

WordPress plugin Video Gallery 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An authorization issue vulnerability exists...

Printix Cloud Print Management 授权问题漏洞

Printix Cloud Print Management is a tool from Printix used to help print from any internet-connected device. An authorization issue vulnerability exists in Printix Cloud Print Management v1.3.1149.0 that stems from its improper privilege control...

CVE-2022-2661

CVE-2022-2661 affects Sequi PortBloque S (serial Modbus firewall) and is an improper authorization vulnerability (CWE-285) that may allow a low-privileged user to perform administrative functions via specially crafted requests. Public sources describe the product as affected across versions and i...

Aviatrix Gateway 授权问题漏洞

Aviatrix Gateway is a single common platform for multi-cloud networks from Aviatrix USA. A security vulnerability in Aviatrix Gateway versions prior to 6.6.5712 and 6.7.x prior to 6.7.1376 stems from an API function that improperly handles authentication, allowing an authenticated VPN user to...

JetBrains Ktor framework 授权问题漏洞

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A security vulnerability exists in JetBrains Ktor framework versions prior to 2.1.0, which stems from the possibility that a user may select the wrong authentication under certain circumstances...

Authorization

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discyupdateoptions action, allowing any logged in users with privileges as low as Subscriber, to change Theme options by sending a crafted POST request...

WordPress Plugin Discy 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2022-31155 Unauthorized overwriting of saved searches in Sourcegraph

Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only...