Huawei HarmonyOS Wearables 授权问题漏洞

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI have a security vulnerability that could be exploited by attackers to compromise service confidentiality...

Calibre 授权问题漏洞

Calibre is an open source, free, all-in-one eBook reading management and format conversion tool from Kovid Goyal, an individual developer in India. An authorization issue vulnerability exists in Calibre, which stems from the product's devices/linuxmounthelper.c file not validating user privileges...

FreeSWITCH 访问控制错误漏洞

FreeSWITCH is a free, open-source communications software program developed by Anthony Minessale, an individual developer in the United States. The software can be used to create audio, video, and short message products and applications. An authorization issue vulnerability exists in FreeSWITCH...

OTRS 授权问题漏洞

OTRS is an application from the German company OTRS. A service management software. An authorization issue vulnerability exists in OTRS, which arises from a product that allows resources to be locked without Owner rights and can be moved to a queue with rw rights for full control. The following...

CVE-2021-41130

CVE-2021-41130 affects Extensible Service Proxy (ESP), specifically ESPv1, where the verified JWT claim is exposed to the application via the HTTP header X-Endpoint-API-UserInfo. If a client sends two such headers, ESPv1 only replaces the first, allowing the second header to reach the application...

Samsung Galaxy Store 授权问题漏洞

Samsung Mobile Samsung Galaxy Store is an application store of Samsung Mobile, a South Korean company. A security vulnerability in SamsungAccountSDKSigninActivity in Samsung Galaxy Store versions prior to 4.5.32.4 allows an attacker to exploit the vulnerability to access the Galaxy Store's conten...

IBM Cloud Pak for Security 授权问题漏洞

IBM Cloud Pak for Security CP4S is an open security platform from IBM that connects to your existing data sources, generates deeper insights, and enables you to act faster with automation. IBM Cloud Pak for Security CP4S suffers from an authorization issue vulnerability in versions 1.7.0.0,...

GHSA-F794-R6XC-HF3V Improper Access Control in passport-oauth2

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

Huawei Hero-Ct060 授权问题漏洞

Huawei Hero-Ct060 is a smart wireless Bluetooth headset from Huawei China.A security vulnerability exists in versions prior to Huawei Hero-Ct060 1.0.0.200. The vulnerability stems from the program's failure to adequately authenticate the user's identity. An attacker could exploit the vulnerabilit...

Trend Micro ServerProtect Authorization Issues Vulnerability

Trend Micro ServerProtect is an enterprise-grade anti-virus program from Trend Micro, Inc. It is used to protect network-connected storage systems and block threats at the source. Trend Micro ServerProtect suffers from an authorization problem vulnerability that originates from an error in the...

Moodle 授权问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an authorization issue vulnerability that stems from a type juggling issue in the external database authentication...

多款 Apple 产品授权问题漏洞

Apple iOS and others are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple watchOS is a smart watch operating system.Apple watchOS is a smart watch operating system.Apple watchOS is a smart watch operating...

Revenera FlexNet Code Insight 授权问题漏洞

Revenera FlexNet Code Insight is a single integrated solution for open source license compliance and security from Revenera, Germany. An authorization issue vulnerability exists in Code Insight because the product does not effectively handle Spring MVC responses, which can be exploited to cause a...

Microsoft Azure 授权问题漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. An authorization issue vulnerability exists in Microsoft Azure Open Management Infrastructure. The following products and versions are affected:Azure Open Management Infrastructure...

Samsung Internet 授权问题漏洞

Samsung Internet is a cell phone application from Samsung South Korea. It provides a browser function. A security vulnerability exists in samsung Internet prior to version 15.0.2.47, which arises from improper design or implementation during code development of a networked system or product...

CVE-2021-3049

CVE-2021-3049 affects Palo Alto Networks Cortex XSOAR server. The issue is an improper authorization that lets an authenticated attacker with investigation read permissions download files from incident investigations they are aware of but not part of. Affected: Cortex XSOAR 5.5.0 and 6.1.0 (befor...

Cisco BroadWorks CommPilot 授权问题漏洞

Cisco BroadWorks CommPilot is a carrier-grade unified communications software platform optimized for performance and scale from Cisco.BroadWorks is hosted by service providers and enables the deployment of cloud calls from a common network platform on any type of wired or wireless network...

Huawei HarmonyOS 授权问题漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based, distributed operating system. Huawei HarmonyOS has a security vulnerability that originates from improper design or implementation during code development of a network system or product. An...

CVE-2021-40379

CVE-2021-40379 affects Compro IP70 (2.08_7130218), IP570 (2.08_7130520), IP60, and TN540 devices. The vulnerability is an unauthenticated RTSP access issue: rstp://.../medias2 does not require authorization, enabling leakage of video streams. CONNECTED documents corroborate unauthenticated access...

CVE-2021-36029

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...