ThinkStation 授权问题漏洞

Lenovo ThinkStation is a desktop workstation from the Chinese company Lenovo. An authorization issue vulnerability exists in ThinkStation, which can be exploited to gain unauthorized access to the boot menu when "BIOS Password At Boot Device List" is set to True...

SAP Commerce 授权问题漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management, and operations management. SAP Commerce suffers from an authorization issue vulnerability that stems from the product's lack of authorization...

Barrier 授权问题漏洞

Barrier is software that mimics the functionality of a Kvm switcher. Barrier suffers from an authorization issue vulnerability that can be exploited by attackers to cause a denial of service or information disclosure...

Barrier Authorization Issues Vulnerability

Barrier is software that mimics the functionality of the Kvm switcher. Barrier suffers from an authorization problem vulnerability that can be exploited by an attacker to enter an active session state using the Barrier component by simply providing a client tag that identifies a valid client...

Hitachi Vantara Pentaho 授权问题漏洞

Hitachi Pentaho is a service from Hitachi Japan for storing and managing data in a Big Data environment. An authorization issue vulnerability exists in Hitachi Vantara Pentaho that stems from an issue discovered in Hitachi Vantara Pentaho via 9.1 and Pentaho Business Intelligence Server via 7.x...

CVE-2021-41238 Missing Authorization with Default Settings in Dashboard UI

Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate process required. Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no...

Publify 授权问题漏洞

Publify is a simple but full-featured web publishing software. Publify suffers from a security vulnerability that stems from a lack of effective permissions licensing and access control measures on a networked system or product...

Phone Shop Sales Managements System 授权问题漏洞

SourceCodester Phone Shop Sales Managements System is a PHP project from SourceCodester, Inc. that manages phone store sales transactions. An authorization issue vulnerability exists in PHP Phone Shop Sales Managements System, which arises from a lack of valid permission grants and access control...

Huawei HarmonyOS Wearables 授权问题漏洞

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI have a security vulnerability that could be exploited by attackers to compromise service confidentiality...

Huawei Smartphone 后置链接漏洞

The Huawei Smartphone is a smartphone from the Chinese company Huawei. An authorization issue vulnerability exists in multiple Huawei devices, which stems from the product allowing unauthorized access to certain files. An attacker can exploit the vulnerability to potentially tamper with files...

Calibre 授权问题漏洞

Calibre is an open source, free, all-in-one eBook reading management and format conversion tool from Kovid Goyal, an individual developer in India. An authorization issue vulnerability exists in Calibre, which stems from the product's devices/linuxmounthelper.c file not validating user privileges...

FreeSWITCH 访问控制错误漏洞

FreeSWITCH is a free, open-source communications software program developed by Anthony Minessale, an individual developer in the United States. The software can be used to create audio, video, and short message products and applications. An authorization issue vulnerability exists in FreeSWITCH...

OTRS 授权问题漏洞

OTRS is an application from the German company OTRS. A service management software. An authorization issue vulnerability exists in OTRS, which arises from a product that allows resources to be locked without Owner rights and can be moved to a queue with rw rights for full control. The following...

CVE-2021-41130

CVE-2021-41130 affects Extensible Service Proxy (ESP), specifically ESPv1, where the verified JWT claim is exposed to the application via the HTTP header X-Endpoint-API-UserInfo. If a client sends two such headers, ESPv1 only replaces the first, allowing the second header to reach the application...

Samsung Galaxy Store 授权问题漏洞

Samsung Mobile Samsung Galaxy Store is an application store of Samsung Mobile, a South Korean company. A security vulnerability in SamsungAccountSDKSigninActivity in Samsung Galaxy Store versions prior to 4.5.32.4 allows an attacker to exploit the vulnerability to access the Galaxy Store's conten...

IBM Cloud Pak for Security 授权问题漏洞

IBM Cloud Pak for Security CP4S is an open security platform from IBM that connects to your existing data sources, generates deeper insights, and enables you to act faster with automation. IBM Cloud Pak for Security CP4S suffers from an authorization issue vulnerability in versions 1.7.0.0,...

GHSA-F794-R6XC-HF3V Improper Access Control in passport-oauth2

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

Huawei Hero-Ct060 授权问题漏洞

Huawei Hero-Ct060 is a smart wireless Bluetooth headset from Huawei China.A security vulnerability exists in versions prior to Huawei Hero-Ct060 1.0.0.200. The vulnerability stems from the program's failure to adequately authenticate the user's identity. An attacker could exploit the vulnerabilit...

Trend Micro ServerProtect Authorization Issues Vulnerability

Trend Micro ServerProtect is an enterprise-grade anti-virus program from Trend Micro, Inc. It is used to protect network-connected storage systems and block threats at the source. Trend Micro ServerProtect suffers from an authorization problem vulnerability that originates from an error in the...

Moodle 授权问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an authorization issue vulnerability that stems from a type juggling issue in the external database authentication...