GHSA-F794-R6XC-HF3V Improper Access Control in passport-oauth2

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

Huawei Hero-Ct060 授权问题漏洞

Huawei Hero-Ct060 is a smart wireless Bluetooth headset from Huawei China.A security vulnerability exists in versions prior to Huawei Hero-Ct060 1.0.0.200. The vulnerability stems from the program's failure to adequately authenticate the user's identity. An attacker could exploit the vulnerabilit...

Trend Micro ServerProtect Authorization Issues Vulnerability

Trend Micro ServerProtect is an enterprise-grade anti-virus program from Trend Micro, Inc. It is used to protect network-connected storage systems and block threats at the source. Trend Micro ServerProtect suffers from an authorization problem vulnerability that originates from an error in the...

Moodle 授权问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an authorization issue vulnerability that stems from a type juggling issue in the external database authentication...

多款 Apple 产品授权问题漏洞

Apple iOS and others are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple watchOS is a smart watch operating system.Apple watchOS is a smart watch operating system.Apple watchOS is a smart watch operating...

Revenera FlexNet Code Insight 授权问题漏洞

Revenera FlexNet Code Insight is a single integrated solution for open source license compliance and security from Revenera, Germany. An authorization issue vulnerability exists in Code Insight because the product does not effectively handle Spring MVC responses, which can be exploited to cause a...

Microsoft Azure 授权问题漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. An authorization issue vulnerability exists in Microsoft Azure Open Management Infrastructure. The following products and versions are affected:Azure Open Management Infrastructure...

Samsung Internet 授权问题漏洞

Samsung Internet is a cell phone application from Samsung South Korea. It provides a browser function. A security vulnerability exists in samsung Internet prior to version 15.0.2.47, which arises from improper design or implementation during code development of a networked system or product...

CVE-2021-3049

CVE-2021-3049 affects Palo Alto Networks Cortex XSOAR server. The issue is an improper authorization that lets an authenticated attacker with investigation read permissions download files from incident investigations they are aware of but not part of. Affected: Cortex XSOAR 5.5.0 and 6.1.0 (befor...

Cisco BroadWorks CommPilot 授权问题漏洞

Cisco BroadWorks CommPilot is a carrier-grade unified communications software platform optimized for performance and scale from Cisco.BroadWorks is hosted by service providers and enables the deployment of cloud calls from a common network platform on any type of wired or wireless network...

Huawei HarmonyOS 授权问题漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based, distributed operating system. Huawei HarmonyOS has a security vulnerability that originates from improper design or implementation during code development of a network system or product. An...

CVE-2021-40379

CVE-2021-40379 affects Compro IP70 (2.08_7130218), IP570 (2.08_7130520), IP60, and TN540 devices. The vulnerability is an unauthenticated RTSP access issue: rstp://.../medias2 does not require authorization, enabling leakage of video streams. CONNECTED documents corroborate unauthenticated access...

CVE-2021-36029

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...

Compro Technology Camera 授权问题漏洞

Compro Technology Camera is a camera from Compro Technology China. An authorization issue vulnerability exists on Compro Technology Camera IP70 2.08 7130218, IP570 2.08 7130520, IP60, and TN540 devices, which stems from cameralist.cgi and setcamera.cgi leaking credentials...

Ivanti Workspace Control 授权问题漏洞

Ivanti Workspace Control RES One Workspace is a set of workspace control software from Ivanti, USA. The software includes features such as user management, application management, and report management. An authorization issue vulnerability exists in Ivanti Workspace Control that stems from the...

ZOHO ManageEngine ServiceDesk Plus 访问控制错误漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, etc. An authorization issue vulnerability exists in...

Apple iOS 授权问题漏洞

Apple iOS is a suite of operating systems developed by Apple Inc. for mobile devices. An authorization issue vulnerability exists in Apple iOS 15 and prior versions of iPadOS 15, which arises from a lack of authentication measures or insufficient authentication strength in a networked system or...

Mitel Networks MiCollab 授权问题漏洞

An authorization issue vulnerability exists in Mitel Networks MiCollab, a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing, and team collaboration for employees, and stems from the product's MiCollab Client Service component does not validate...

SAP Business One 授权问题漏洞

SAP Business One is a suite of enterprise management software from SAP, a German company. The software includes financial management, operations management, and human resources management functions.SAP Business One has an authorization problem vulnerability that stems from a lack of authenticatio...

Netgear RBR750 授权问题漏洞

Netgear RBR750 is a home WiFi system from Netgear, Inc. Multiple NETGEAR devices are vulnerable to an access control error, which stems from the product not properly restricting access from unauthorized roles. No details of the vulnerability are currently available...