CVE-2023-37890

CVE-2023-37890 affects KB Support – WordPress Help Desk and Knowledge Base (WordPress plugin) up to version 1.5.88. The issue is a Missing Authorization flaw that allows users with role as low as subscriber to view other customers’ data. Exploitation details are not provided in the initial docume...

ZITADEL Authorization Issues Vulnerability

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless in the Swiss ZITADEL open source. An authorization issue vulnerability exists in ZITADEL versions prior to 2.41.6, prior to 2.40.10, and prior to 2.39.9,...

Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An authorization issue vulnerability exists in Apache Superset versions prior to 2.1.2 that stems from the presence of incorrect authorization checks. An attacker could exploit this vulnerability...

CSZCMS License Issue Vulnerability

CSZCMS is an open source web application that allows managing all content and settings on a website. An authorization issue vulnerability exists in CSZCMS version 1.3.0, which stems from an unknown function in the file view template in the component File Manager Page, resulting in a permissions...

Ray Missing Authorization vulnerability

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...

Zoom Client Authorization Issues Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. An authorization issue vulnerability exists in Zoom Client that stems from improper authorization. An authorized user could be allowed to escalate privileges via web access...

GitLab 14.7 < 16.3.6 / 16.4.0 < 16.4.2 / 16.5.0 < 16.5.1 (CVE-2023-4700)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments,...

CVE-2023-42553

Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email...

Atlassian Confluence 8.x < 8.3.4 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.x prior 7.19.6, 8.x prior to 8.3.4, 8.4.x prior to 8.4.4, 8.5.x prior to 8.5.3 or 8.6.x prior to 8.6.1. It is, therefore, affected by an improper authorization vulnerability. Note...

Authorization

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

CVE-2023-5862 Missing Authorization in hamza417/inure

Missing Authorization in GitHub repository hamza417/inure prior to Build95...

WordPress Blog2Social Plugin < 6.9.12 Missing Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adenion:blog2social"; ifdescription...

WordPress Plugin wpDiscuz Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-36556

An incorrect authorization vulnerability CWE-863 in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests...

SAP S/4HANA 安全漏洞

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. An authorization issue vulnerability exists in SAP S/4HANA version 106, which can be exploited by an attacker to cause an escalation of privileges, due to a vulnerability...

ZITADEL Authorization Issues Vulnerability

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL in Switzerland. An authorization issue vulnerability exists in ZITADEL 2.37.2 and earlier versions, which stems from the fact that an...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. Huawei HarmonyOS and EMUI are vulnerable to an...

NETIS SYSTEMS N3 Security Vulnerability

NETIS SYSTEMS N3 is a router from NETIS SYSTEMS. A security vulnerability exists in the NETIS SYSTEMS N3Mv2-V1.0.1.865 version that originates from a vulnerability that allows an attacker to cause a denial of service DoS via the authorization component of an HTTP request...

Mattermost Server < 7.8.10 / 8.x < 8.1.1 Incorrect Authorization (MMSA-2023-00223)

The version of Mattermost Server running on the remote host is prior to 7.8.10 or 8.x prior to 8.1.1. It is, therefore, affected by an incorrect authorization vulnerability. Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager ...