Softing Secure Integration Server 授权问题漏洞

Softing Secure Integration Server is a secure integration server from Softing Germany. It provides a robust OPC UA data integration layer and supports interface abstraction, aggregation, data preprocessing, and security supervision. An authorization issue vulnerability exists in Softing Secure...

HUAWEI EMUI 安全漏洞

HUAWEI EMUI / Magic UI are both an Android-based mobile operating system developed by China's Huawei HUAWEI. HUAWEI EMUI / Magic UI has an authorization issue vulnerability, which stems from improper control of the Bluetooth module permissions and is used by attackers to affect the integrity of t...

Counter Box < 1.2.1 - Arbitrary Counter Activation/Deactivation via CSRF

The plugin is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks PoC https://example.com/wp-admin/admin.php?page=counter-box=1=activate...

Dovecot 授权问题漏洞

Dovecot is an open source IMAP and POP3 mail server for Linux/UNIX-like systems. An authorization issue vulnerability exists in Open-Xchange Dovecot version 2.2 that stems from a possible elevation of privilege when using similar master and non-master passwords...

HUAWEI HarmonyOS 安全漏洞

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. HUAWEI HarmonyOS version 2.0 contains an authorization issue vulnerability that stems from an incorrect privilege assignment in the application security module, which could be exploited by an attacker to cause the device to...

Alibaba nacos 授权问题漏洞

Alibaba nacos is a dynamic service discovery, configuration and service management platform for Alibaba in China. The software supports both DNS-based and RPC-based service discovery, and provides features such as providing real-time health checks to prevent services from sending requests to...

Jenkins Failed Job Deactivator Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Failed Job Deactivator Plugin...

CVE-2022-2244

An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature...

Exemys RME1 授权问题漏洞

The Exemys RME1 is an analog acquisition module with multiple communication protocols from Exemys Argentina. An authorization issue vulnerability exists in the Exemys RME1 that originates from bypassing the authentication scheme and performing administrative operations by using a specific...

D-Link DIR-850 授权问题漏洞

The D-Link DIR-850 is a wireless router from AUO D-Link of Taiwan, China. An authorization issue vulnerability exists in D-Link DIR-850L 1.21WW. An attacker can exploit this vulnerability to access the network by sending packets on data frames to the AP...

Cisco AppDynamics Controller 安全漏洞

Cisco AppDynamics Controller is Cisco's ability to monitor and analyze full-stack data through accurate tracking and analysis across a highly distributed application environment. Cisco AppDynamics Controller suffers from an authorization issue vulnerability that arises from incorrect authorizatio...

CVE-2022-1777

The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload...

WordPress plugin Filr 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

CVE-2022-1935

Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when I...

Authorization

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information wifikey, etc. without authorization through getSysStatusCfg...

GitLab 授权问题漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. GitLab Community Edition and GitLab Enterprise Edition have an authorization issue...

CVE-2022-26691

An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as root/admin without the 32-byte secret key and perform arbitrary code execution. Mitigation Red Hat has...

GHSA-CC3W-R3W8-HFH7 Magento Improper Authorization vulnerability in the customers module

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for...

Session tokens are not invalidated on logout

Description The session cookie is not invalidated on logout so, it can be used after logout as well. Proof of Concept Login to the Nakama console. Intercept the request. Below is a sample request: http GET /v2/console/user HTTP/1.1 Host: localhost:7351 Accept: application/json, text/plain, /...

PT-2022-17170

Name of the Vulnerable Software and Affected Versions Bonita Web version 2021.2 Description Bonita Web 2021.2 is affected by an authentication/authorization bypass due to an overly permissive exclusion pattern within the RestAPIAuthorizationFilter. Appending ;i18ntranslation or /../i18ntranslatio...