Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not performing authorization checks in the playbooks plugin, allowing unauthorized attackers to gain access to uninternal information...

PT-2023-32752 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to perform correct authorization checks when creating a playbook action. This allows users without access to the playbook to create playbook...

GHSA-PHMW-JX86-X666 Authenticated Rundeck users can view or delete jobs they do not have authorization for.

Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. The affected URLs are: - https://host/context/rdJob/ -...

Authenticated Rundeck users can view or delete jobs they do not have authorization for.

Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. The affected URLs are: - https://host/context/rdJob/ -...

SAP Business One 访问控制错误漏洞

SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. An access control error vulnerability exists in SAP Business One version 10.0, which stems from not performing...

CVE-2023-42473

S/4HANA Manage Withholding Tax Items - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application...

CVE-2023-42473 Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)

S/4HANA Manage Withholding Tax Items - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application...

CVE-2023-42473

S/4HANA Manage (Withholding Tax Items) in version 106 is affected by missing authorization checks for authenticated users, enabling privilege escalation with low impact to confidentiality and integrity. The vulnerability stems from insufficient access control in the authorization flow, as describ...

PT-2023-30798 · WordPress · Wordpress File Sharing Plugin

Name of the Vulnerable Software and Affected Versions: WordPress File Sharing Plugin versions prior to 2.0.5 Description: The issue allows users to gain access to files and folders by manipulating IDs, which can be easily brute forced, due to a lack of authorization checks. Recommendations: For...

Siemens QMS Automotive Access Control Error Vulnerability

Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. Siemens QMS Automotive suffers from an Access Control Error vulnerability that stems from a lack of sufficient authorization checks in the QMS.Mobile module of the affected application. An...

Allowance manipulation in UserEscrow struct leads to unauthorized token transfers due to overreliance on maximum allowance check

Lines of code Vulnerability details Summary The UserEscrow smart contract contains a vulnerability that can possibly allow unauthorized users to transfer tokens out of the contract. Specifically, an attacker can exploit this flaw by manipulating the allowances, thus enabling them to bypass the...

CVE-2023-40730

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application lacks sufficient authorization checks. This could allow an attacker to access confidential information, perform administrative functions, or lead to a denial-of-service...

CVE-2023-40730

Summary : CVE-2023-40730 affects Siemens QMS Automotive, specifically the QMS.Mobile module in all versions prior to 12.39. The root cause is insufficient authorization checks that could let an attacker access confidential information, perform administrative actions, or cause a denial-of-service....

CVE-2023-40625

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-40309

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-40625

CVE-2023-40625 involves the SAP S4CORE Manage Purchase Contracts App where versions 102–107 do not perform necessary authorization checks for authenticated users, enabling potential privilege escalation. Connected source PT-2023-27547 corroborates the affected versions and notes remediation: upgr...

SAP S4CORE Security Vulnerability

SAP S4CORE is a Manage Purchase Contracts App from SAP, Germany. A security vulnerability exists in SAP S4CORE Manage Purchase Contracts App versions 102, 103, 104, 105, 106, and 107, which originates from a failure to perform the required authorization checks on authenticated users, allowing an...

PT-2023-27547 · S4Core · S4Core

Name of the Vulnerable Software and Affected Versions: S4CORE Manage Purchase Contracts App versions 102 through 107 Description: The issue is related to the lack of necessary authorization checks for authenticated users, which could allow an attacker to perform unintended actions, resulting in...

PT-2023-6624 · Sap · Sap Commoncryptolib

Name of the Vulnerable Software and Affected Versions: SAP CommonCryptoLib affected versions not specified Description: The issue is related to insufficient authorization checks in the SAP CommonCryptoLib library. This can lead to an escalation of privileges, allowing a remote attacker to read,...

CVE-2023-2173

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeosdeletestepajaxhandler, badgeosdeleteawardstepajaxhandler, badgeosdeletedeductstepajaxhandler,...