PrivateUploader License Issue Vulnerability

PrivateUploader is the ultimate open source image uploader and file storage solution. An authorization issue vulnerability exists in versions prior to PrivateUploader 3.2.49, which stems from not properly validating whether a user is an administrator high level or a moderator low level, causing...

CVE-2023-38209

Adobe Commerce/Open Source Magento versions 2.4.4-p4–2.4.6-p1 (and earlier) are affected by an Incorrect Authorization vulnerability that permits a low-privileged attacker to access other users’ data without user interaction. The issue stems from improper access control and has a high confidentia...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation suffers from an authorization issue vulnerabili...

Pre-Auth SQLi leading to RCE in Social Media Skeleton v1.0

Summary A SQL Injection vulnerability exists in Social Media Skeleton v1.0 via the username and password parameters in admin/login.php. Not to be confused with login.php, which properly escapes special characters. Issue Description SQL injection SQLi is a code injection technique used to attack...

Insufficient Session Expiration

getkirby/cms is vulnerable to Insufficient Session Expiration. The vulnerability exists because web sessions are not properly expired which permits an attacker to reuse old session credentials or session IDs for authorization...

Authorization

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow...

CVE-2023-3442 Missing Authorization in Jenkins plug-in for ServiceNow DevOps

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow...

CVE-2023-3442

CVE-2023-3442 affects the Jenkins Plug-in for ServiceNow DevOps prior to version 1.38.1. The issue is a missing authorization check that could allow exposure of sensitive information when exploited. The advisory explicitly recommends updating the plugin on Jenkins servers to 1.38.1; no changes ar...

Authorization

Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push policies to unauthorized tenant group...

CVE-2023-32482

Dell Wyse Management Suite is affected by an improper authorization vulnerability (CVE-2023-32482) where an authenticated user with privileged access can push policies to unauthorized tenant groups. The CVE entry indicates affected software: Wyse Management Suite versions prior to 4.0; the CNVD/D...

Weintek Weincloud 授权问题漏洞

Weintek Weincloud is a cloud-based monitoring platform from Weintek, Inc. An authorization issue vulnerability exists in Weintek Weincloud version v0.13.6, which stems from a vulnerability that could allow an attacker to reset passwords using only the JWT token of the corresponding account...

Weintek Weincloud 授权问题漏洞

Weintek Weincloud is a cloud-based monitoring platform from Weintek, Inc. An authorization issue vulnerability exists in Weintek Weincloud version v0.13.6, which stems from a vulnerability that could allow an attacker to abuse the registration feature and log in to the official website using test...

Mattermost 授权问题漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from the fact that all previous tokens are not invalidated when a new reset token is created...

Warpgate 授权问题漏洞

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux from the warp-tech project. Warpgate suffers from an authorization problem vulnerability that stems from the fact that when logged in as an SSO-enabled user, an attacker may be able to pass authentication as another user...

Discourse 授权问题漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. Discourse suffers from an authorization issue vulnerability that stems from allowing attackers to bypass topic title validation. Affected products and versions:...

CVE-2023-37951

CVE-2023-37951 affects Jenkins mabl Plugin versions 0.0.46 and earlier. The issue arises because the plugin does not set the appropriate context for credentials lookup, enabling attackers with Item/Configure permission to access and capture credentials they should not access. The vulnerability im...

CVE-2023-30428

CVE-2023-30428: Apache Pulsar Broker Rest Producer improper authorization allows an authenticated user with a custom HTTP header to produce messages to any topic using the broker’s admin role. Affected: Pulsar Brokers 2.9.0–2.9.5; 2.10.0–2.10.3; 2.11.0. Exploitation requires direct broker access ...

CVE-2023-30428 Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from...

PT-2023-9534 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite component: Site Hierarchy Flows versions 12.2.3 through 12.2.13 Description: The issue is related to authorization errors in the Site Hierarchy Flows component of Oracle Site Hub in Oracle E-Business Suite. This can be...

Apache Pulsar 安全漏洞

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenant, persistent storage, multi-machine room cross-region data replication,...