Ivanti Workspace Control 授权问题漏洞

Ivanti Workspace Control RES One Workspace is a set of workspace control software from Ivanti, USA. The software includes features such as user management, application management, and report management. An authorization issue vulnerability exists in Ivanti Workspace Control that stems from the...

Compro Technology Camera 授权问题漏洞

Compro Technology Camera is a camera from Compro Technology China. An authorization issue vulnerability exists on Compro Technology Camera IP70 2.08 7130218, IP570 2.08 7130520, IP60, and TN540 devices, which stems from cameralist.cgi and setcamera.cgi leaking credentials...

ZOHO ManageEngine ServiceDesk Plus 访问控制错误漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, etc. An authorization issue vulnerability exists in...

Apple iOS 授权问题漏洞

Apple iOS is a suite of operating systems developed by Apple Inc. for mobile devices. An authorization issue vulnerability exists in Apple iOS 15 and prior versions of iPadOS 15, which arises from a lack of authentication measures or insufficient authentication strength in a networked system or...

Mitel Networks MiCollab 授权问题漏洞

An authorization issue vulnerability exists in Mitel Networks MiCollab, a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing, and team collaboration for employees, and stems from the product's MiCollab Client Service component does not validate...

Magento Commerce 安全漏洞

Magento Commerce is to provide a best-in-class shopping experience without developer support. Magento Commerce has a security vulnerability that exists due to insufficient authorization checks. A remote administrator can bypass implemented security restrictions and gain unauthorized access to the...

多款Netgear产品授权问题漏洞

Netgear WNR3500L and others are products of Netgear, Inc.WNR3500L is a wireless router.WN2500RP is a wireless network signal extender.NETGEAR is a router. An authorization issue vulnerability exists in multiple NETGEAR devices. the vulnerability stems from the product not properly restricting...

Netgear RBR750 授权问题漏洞

Netgear RBR750 is a home WiFi system from Netgear, Inc. Multiple NETGEAR devices are vulnerable to an access control error, which stems from the product not properly restricting access from unauthorized roles. No details of the vulnerability are currently available...

SAP Business One 授权问题漏洞

SAP Business One is a suite of enterprise management software from SAP, a German company. The software includes financial management, operations management, and human resources management functions.SAP Business One has an authorization problem vulnerability that stems from a lack of authenticatio...

CVE-2021-24501 Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site...

Vmware vRealize Automation 授权问题漏洞

Vmware vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation from Vmware, Inc. An authorization issue vulnerability exists in Vmware vRealize Automation version 7.6, which stems from the software not adequately validating user-supplied input in the...

IBM PowerVM Hypervisor 授权问题漏洞

IBM PowerVM Hypervisor is an application from Universal Business Machines IBM, Inc. provides a secure and scalable virtualized environment for applications built on the advanced RAS features and leading performance of the Power Systems platform. An authorization issue vulnerability exists in IBM...

Arbitrary file deletion

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3...

多款Qualcomm产品授权问题漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuitry including primarily semiconductor devices, but also passive components, etc., and from time to time fabricated on the surface of semiconductor wafers. An authorization issue vulnerability exists in various...

Motorola CX2 授权问题漏洞

The Motorola CX2 is a wireless router from Motorola. An authorization issue vulnerability exists in the Motorola CX2 router, which stems from the lack of an effective privilege control mechanism in the product's login.html. The vulnerability can be exploited to bypass login and obtain an authoriz...

CVE-2021-36230

CVE-2021-36230 affects HashiCorp Terraform Enterprise; the issue arises from missing authorization checks on a subset of API requests executed with the run token, enabling privilege escalation to the organization owner. Affected releases are up to v202106-1, with a fix in v202107-1. The risk deta...

CVE-2021-36230

HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1...

Citrix Application Delivery Controller授权问题漏洞

Citrix Systems Citrix Application Delivery Controller ADC is an application delivery controller from Citrix Systems. The product has features such as application delivery control and load balancing. Citrix Application Delivery Controller has a security vulnerability, please follow the vendor's...

Oracle E-Business Suite 输入验证错误漏洞

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and other management software collection, is seamlessly integrated with a management suite.Oracle Public Sector...

Improper Privilege Management in uvdesk/core-framework

✍️ BUG privilege escalation bug to pin a threads 🕵️‍♂️ Proof of Concept 1. Frist from admin account goto http://localhost/uvdesk/public/en/member/agents and add new user called user B with Agent role .\ Now gives user-B all tikceting permission like can update/add/edit/delete/lock/pin to a ticket...