CVE-2021-39930

Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates...

CVE-2021-20867

CVE-2021-20867 affects Advanced Custom Fields (ACF) and ACF Pro versions prior to 5.11. The root cause is a missing authorization mechanism for moving field groups, which could allow an attacker to move field groups they should not access via unspecified vectors. Public sources in the connected d...

CVE-2021-20867

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors...

CVE-2021-20866

The CVE-2021-20866 vulnerability affects Advanced Custom Fields (ACF) and ACF Pro prior to version 5.11. The issue is a missing authorization in obtaining the user list, leading to potential information disclosure of unauthorized user data via unspecified vectors. Public sources in Patchstack ind...

CVE-2021-20865

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors...

Synel Eharmonynew 授权问题漏洞

Synel Eharmonynew is a time and attendance system from Synel Israel. Synel eharmonynew suffers from an authorization issue vulnerability that stems from the ability to log in to the system using default credentials and export eHarmony system reports containing sensitive data employee names,...

FortiClient (Windows) - Web filter bypass

An improper authorization vulnerabiltiy CWE-285 in FortiClient Windows may allow an unauthenticated attacker to bypass the webfilter control via modifying the session-id paramater...

GOautodial 授权问题漏洞

GOautodial is a next-generation open source omnichannel contact center suite. Goautodial suffers from an authorization issue vulnerability that arises when the API in the software does not properly validate usernames and passwords, allowing callers to specify any value for a parameter and...

ZOHO ManageEngine Desktop Central MSP 授权问题漏洞

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs managed service providers from ZOHO. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks and provides differentiated management...

WordPress plugin Bulk Datetime Change 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. An authorization issue vulnerability exists in the WordPress Bulk Datetime Change plugin, which stems from a...

Team Password Manager 授权问题漏洞

Team Password Manager is a web-based team password manager. Team Password Manager suffers from an authorization issue vulnerability that arises from improper design or implementation during code development of a web-based system or product...

ThinkStation 授权问题漏洞

Lenovo ThinkStation is a desktop workstation from the Chinese company Lenovo. An authorization issue vulnerability exists in ThinkStation, which can be exploited to gain unauthorized access to the boot menu when "BIOS Password At Boot Device List" is set to True...

SAP Commerce 授权问题漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management, and operations management. SAP Commerce suffers from an authorization issue vulnerability that stems from the product's lack of authorization...

Barrier Authorization Issues Vulnerability

Barrier is software that mimics the functionality of the Kvm switcher. Barrier suffers from an authorization problem vulnerability that can be exploited by an attacker to enter an active session state using the Barrier component by simply providing a client tag that identifies a valid client...

Barrier 授权问题漏洞

Barrier is software that mimics the functionality of a Kvm switcher. Barrier suffers from an authorization issue vulnerability that can be exploited by attackers to cause a denial of service or information disclosure...

Hitachi Vantara Pentaho 授权问题漏洞

Hitachi Pentaho is a service from Hitachi Japan for storing and managing data in a Big Data environment. An authorization issue vulnerability exists in Hitachi Vantara Pentaho that stems from an issue discovered in Hitachi Vantara Pentaho via 9.1 and Pentaho Business Intelligence Server via 7.x...

CVE-2021-41238 Missing Authorization with Default Settings in Dashboard UI

Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate process required. Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no...

Phone Shop Sales Managements System 授权问题漏洞

SourceCodester Phone Shop Sales Managements System is a PHP project from SourceCodester, Inc. that manages phone store sales transactions. An authorization issue vulnerability exists in PHP Phone Shop Sales Managements System, which arises from a lack of valid permission grants and access control...

Publify 授权问题漏洞

Publify is a simple but full-featured web publishing software. Publify suffers from a security vulnerability that stems from a lack of effective permissions licensing and access control measures on a networked system or product...

Huawei Smartphone 后置链接漏洞

The Huawei Smartphone is a smartphone from the Chinese company Huawei. An authorization issue vulnerability exists in multiple Huawei devices, which stems from the product allowing unauthorized access to certain files. An attacker can exploit the vulnerability to potentially tamper with files...