Flowring Technology Agentflow BPM 授权问题漏洞

Flowring Technology Agentflow BPM is an enterprise process management system from Flowring Technology. Flowring Technology Agentflow BPM suffers from an authorization vulnerability that arises from improper authentication of its enterprise management system, which could allow a remote attacker wi...

CVE-2022-39883

Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API...

CVE-2022-44796

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically...

WordPress theme Bricks license issue vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. An authorization issue vulnerability exists in WordPress theme Bricks...

CVE-2022-3401

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability CVE-2022-3400, makes it possible for authenticate...

WordPress theme Bricks 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. An authorization issue vulnerability exists in WordPress theme Bricks...

Metabase 授权问题漏洞

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase that stems from the ability of single sign-on SSO users to reset their passwords on Metabase, which could allow users to access it without going through the SSO IdP...

Shinken 授权问题漏洞

Shinken is a modern, Nagios-compatible monitoring framework from the individual developer Gabès Jean. An authorization issue vulnerability exists in Shinken Monitoring version 2.4.3, which stems from incorrect access control.The SafeUnpickler class in shinken/safepickle.py uses a weak...

CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

Juniper Networks Junos OS 授权问题漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A security vulnerability exists in Juniper Networks Junos OS. No information about this vulnerability is...

Fortinet FortiOS 授权问题漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam. An authorization issue...

The vulnerability of the Lifecycle Management console component of the SAP BusinessObjects Business Intelligence platform allows a perpetrator to gain unauthorized access to protected information, change passwords, or import files into another system.

The vulnerability of the Lifecycle Management console component of the SAP BusinessObjects Business Intelligence platform is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information, change...

Authorization

Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information...

Authorization

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix Javascript SDK prior to version 19.7.0, which stems from matrix-js-sdk implementing an overly lax key forwarding policy on the receiving end...

Bytebase 授权问题漏洞

Bytebase is Bytebase's open source web-based, zero-configuration, dependency-free database schema change and version control management tool for DevOps teams. projects", which can be exploited by an attacker to view "projects" created by "Admin"...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix Javascript SDK prior to version 19.7.0, which stems from a lack of required checks in matrix-js-sdk...

Ericsson Erlang 授权问题漏洞

Ericsson Erlang is a general-purpose concurrency-oriented programming language from Ericsson, Sweden. A security vulnerability exists in Erlang versions prior to 23.3.4.15, 24.x up to 24.3.4.2, and 25.x up to 25.0.2, which stems from bypassing client authentication in certain client-side...

PT-2022-24826 · Unknown · Fhir-Works-On-Aws-Authz-Smart

Name of the Vulnerable Software and Affected Versions: fhir-works-on-aws-authz-smart versions 3.1.1 through 3.1.2 Description: The issue allows a client of the API to retrieve more information than the client's OAuth scope permits when making "search-type" requests. However, this issue would not...

Trend Micro Apex One 授权问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro, Inc. A security vulnerability exists in Trend Micro Apex One version 2024 On-prem SaaS, which stems from the fact that if a remote attacker sends a specially crafted request to the affected product, it could bypass the...