PT-2024-2867 · Totolink · Totolink Ex200

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX200 version 4.0.3c.7646 B20201211 Description: The issue is related to a flaw in the authorization procedure of the setTelnetCfg function in the TOTOLINK EX200 router's firmware. This flaw allows a remote attacker to start the Teln...

PT-2024-25796 · Cp Plus · Cp Plus Wi-Fi Camera

Name of the Vulnerable Software and Affected Versions: CP Plus Wi-Fi Camera versions up to 20240401 Description: A critical issue was found in the User Management component, leading to improper authorization. The manipulation can be launched remotely. The issue affects an unknown functionality of...

PT-2024-2967 · Poly · Poly Ccx

Name of the Vulnerable Software and Affected Versions: Poly CCX devices versions 8.0.2.3267 through 8.1.3.1301 Description: The issue is related to a flaw in the firmware build process that did not properly restrict access to a resource from an unauthorized actor. This flaw is associated with...

The vulnerability of the Grafana monitoring and observation platform, related to incorrect authorization, allows a violator to increase their privileges.

The vulnerability of the Grafana monitoring and observation platform is related to incorrect authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

GHSA-7MG2-6C6V-342R Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints

This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. A...

CVE-2024-23451

An incorrect authorization flaw was found in the API key based security model for Remote Cluster Security in the elasticsearch package. A malicious user with a valid API key can leverage this issue to gain access to read any documents from any index in the remote cluster, exposing possible...

PT-2024-22824 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-9289 Synology Surveillance Station versions prior to 9.2.0-11289 Description: A missing authorization issue in the GetLiveViewPath webapi component allows remote authenticated users to...

Elasticsearch 安全漏洞

Elasticsearch is a search engine based on the Lucene library. A security vulnerability exists in Elasticsearch versions prior to 8.13.0 that stems from an incorrect authorization issue in the API key-based security model, allowing an attacker with a remote cluster API key to read arbitrary...

WordPress Plugin PopupAlly 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Plugin Kikote 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin WholesaleX 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin SalesKing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin PropertyHive 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2024-0779

The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admininit, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example...

CVE-2024-1604

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifi...

Mattermost 访问控制错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization problem vulnerability that stems from an inability to properly verify account ownership, which can be exploited by an authenticated attacker to take over anothe...

WordPress Plugin Legal Pages Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress Plugin Cryptocurrency Widgets Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-21761

An improper authorization vulnerability CWE-285 in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload...

PT-2024-2331 · Unknown · Siveillance Control

Name of the Vulnerable Software and Affected Versions: Siveillance Control versions 2.8 through 3.1.1 Description: A vulnerability has been identified in the affected product, related to insufficient checks on the list of access groups assigned to individual users. This could enable a locally...