CVE-2023-32112 Missing Authorization Check in Vendor Master Hierarchy

Vendor Master Hierarchy - versions SAPAPPL 500, SAPAPPL 600, SAPAPPL 602, SAPAPPL 603, SAPAPPL 604, SAPAPPL 605, SAPAPPL 606, SAPAPPL 616, SAPAPPL 617, SAPAPPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated user to access some of its function. This could lea...

SAP Vendor Master Hierarchy 安全漏洞

SAP Vendor Master Hierarchy is a flexible hierarchical application that reflects the organizational structure of vendors from SAP, Germany. A security vulnerability exists in SAP Vendor Master Hierarchy that originates from not performing the required authorization check access to authenticated...

PT-2023-23621 · Sap · S4Core +1

Name of the Vulnerable Software and Affected Versions: SAP APPL versions 500 through 618 S4CORE version 100 Description: The Vendor Master Hierarchy does not perform necessary authorization checks for an authenticated user to access some of its functions. This could lead to modification of data...

Improper Privilege Management

microweber/microweber is vulnerable to Improper Privilege Management . The vulnerability exists due lack of authorization checks in the apiResource parameter of api.php which allows an attacker to provide malicious configuration-related API parameter...

WordPress plugin WP VR 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Essential Blocks < 4.0.7 - Multiple Functions Missing Authorization Checks

The plugin does not apply authorization checks on multiple sensitive functions in the plugin, making them reachable to users with low privileges like Subscribers. Additionally, its nonce validation logic can be bypassed. Affected functions include: save, get, templates, templatecount,...

CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

CVE-2023-1874 WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

CVE-2023-1874 WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

WordPress WP Data Access 5.3.7 Privilege Escalation

The Wordfence team responsibly disclosed an authenticated Privilege Escalation vulnerability in the WP Data Access plugin. On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin...

WordPress WP Data Access 5.3.7 Privilege Escalation Vulnerability

The Wordfence team responsibly disclosed an authenticated Privilege Escalation vulnerability in the WP Data Access plugin. On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin...

Authorization

SAP HCM Fiori App My Forms Fiori 2.0 - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data...

PT-2023-17327 · Sap · Sap Hcm Fiori App My Forms

Name of the Vulnerable Software and Affected Versions: SAP HCM Fiori App My Forms Fiori 2.0 version 605 Description: The issue concerns the lack of necessary authorization checks for authenticated users, resulting in exposure of restricted header data. Recommendations: For SAP HCM Fiori App My...

SAP HCM Travel Management 代码问题漏洞

SAP HCM Travel Management is a travel management module from SAP, Germany. A code issue vulnerability exists in SAP HCM Travel Management version 605, which stems from a failure to perform required authorization checks on users...

Hitachi Vantara Pentaho Business Analytics Server 安全漏洞

Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server that stems from not properly performing authorization...

PT-2023-2239 · Hitachi Vantara · Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.1 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.2 Hitachi Vantara Pentaho Business Analytics Server version 8.3.x Description: The issue is...

Incorrect Authorization

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Incorrect Authorization due to improper security checks during the authorization process. A low-privileged authenticated attacker can achieve minor...

Teamviewer 安全漏洞

Teamviewer is a suite of software for remote control, desktop sharing, and file transfer from Teamviewer, a German company. A security vulnerability exists in Teamviewer that stems from incorrect authorization checks. An unprivileged user can change local device settings while the options are...

CVE-2023-27268

SAP NetWeaver AS Java Object Analyzing Service - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify...

CVE-2023-27268 Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)

SAP NetWeaver AS Java Object Analyzing Service - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify...