CVE-2021-33671

SAP NetWeaver Guided Procedures Administration Workset, versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. The impact of missing authorization could result to abuse of functionality...

Sql injection

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection...

SAP CRM 安全漏洞

SAP CRM is a customer relationship management system from SAP, a German company. A security vulnerability exists in SAP CRM ABAP, which stems from a lack of authorization checks in the product. The following products and versions are affected: SAP CRM, Versions - 700, 701, 702, 712, 713, 714...

WordPress Workreap premium theme <= 2.2.1 - Missing authorization checks in AJAX actions vulnerability

Missing authorization checks in AJAX actions vulnerability discovered by Harald Eilertsen Jetpack in WordPress Workreap premium theme versions = 2.2.1. Solution Update the WordPress Workreap premium theme to the latest available version at least 2.2.2...

Design/Logic Flaw

MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\MyQ\PHP\Sessions directory. The "Select server file" feature is only intended for administrators but actually does not require authorizatio...

CVE-2021-23014

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software...

Authorization

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software...

CVE-2021-23014

CVE-2021-23014 affects BIG-IP Advanced WAF and ASM REST API. A missing authorization check for file uploads to a specific REST API directory could allow an authenticated user with guest privileges to upload files. Affected branches: 16.x before 16.0.1.1; 15.x before 15.1.3; 14.x before 14.1.4 (Eo...

CVE-2021-24252

The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result,...

Cisco SD-WAN vManage Cluster Mode Unauthorized Service Access Vulnerability

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco. A cluster mode unauthorized service access vulnerability exists in Cisco SD-WAN vManage, which can be exploited by an attacker to bypass authorization checks and gain...

Cisco SD-WAN vManage Software 输入验证错误漏洞

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco. An elevation of privilege vulnerability exists in the web management interface of Cisco SD-WAN vManage, which stems from the software not performing authorization checks on...

PT-2021-3636 · WordPress · Event Banner Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Event Banner WordPress plugin versions prior to 1.4 Description: The issue is related to the lack of verification for uploaded image files, allowing admin accounts to upload arbitrary files, such as .exe or .php, leading to remote code...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM REST API vulnerability (K23203045)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4 / 15.1.3 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K23203045 advisory. - On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP...

Cisco SD-WAN vManage Input Validation Error Vulnerability

Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. Cisco SD-WAN vManage Software has an input validation error vulnerability that originates as a result of insufficient authorization checks. ...

Authorization

SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without the intended authorization...

Event Banner <= 1.3 - Arbitrary File Upload to RCE

The plugin does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation chec...

Authorization

A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to the Cisco Webex Meetings...

CVE-2021-1467 Cisco Webex Meetings for Android Avatar Modification Vulnerability

A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to the Cisco Webex Meetings...

CVE-2021-1467

CVE-2021-1467 affects Cisco Webex Meetings for Android. The issue stems from improper authorization checks, allowing an authenticated remote actor in the same meeting to modify another user’s avatar by sending a crafted request to the targeted Webex client. Impact is limited to avatar modificatio...

PT-2021-2562 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings for Android affected versions not specified Description: A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This issue is due to imprope...