PT-2024-1870 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.4 through 16.7.5 GitLab EE versions 16.8 through 16.8.2 GitLab EE versions 16.9 through 16.9.0 Description: An issue has been discovered in GitLab EE, where users with the Guest role can change Custom dashboard projects...

Lemmy Authorization Issues Vulnerability

Lemmy is Lemmy open source free software for building social news aggregators and web forums. An authorization issue vulnerability exists in Lemmy version 0.17.0 through versions prior to 0.19.1, which stems from the fact that any authenticated user can gain access to arbitrary private message...

Design/Logic Flaw

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...

VulnCheck KEV: CVE-2019-8446

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check...

PT-2024-19397 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.5.7.4 Description: The state handler for orders in the Shopware CMS fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate...

PT-2024-2594 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions 8.10.0 through 8.12.x Description: The issue is related to an Incorrect Authorization problem in the API key based security model for Remote Cluster Security, which is currently in Beta. This allows a malicious user wit...

Huaxia ERP Authorization Issues Vulnerability

Huaxia ERP is an ERP software from Huaxia, China. Huaxia ERP 3.1 and prior versions have an authorization issue vulnerability that originates from the file src/main/java/com/jsh/erp/controller/UserController.java that can lead to weak password recovery...

UBUNTU-CVE-2023-5356

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user...

Tecnick TCExam Security Breach

Tecnick TCExam is a Web-based open source e-exam system from Tecnick UK. The system is mainly used for online exams, etc. A security vulnerability exists in Tecnick TCExam versions prior to 15.1.0, which stems from an insufficiently protected external authorization mechanism in the admin folder...

HuiRan Host Reseller System Authorization Issues Vulnerability

HuiRan Host Reseller System is a host reseller system from HuiRan. An authorization issue vulnerability exists in HuiRan Host Reseller System version 2.0.0 and prior versions, which stems from the file /user/index/findpass?do=4 that can lead to weak password recovery...

CVE-2023-5877

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkpimagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a...

CVE-2023-51380

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and...

Apache Doris 安全漏洞

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from an authorization issue vulnerability that stems from api /api/snapshot and /api/getlogfile allowing...

Stupid Simple CMS Authorization Issues Vulnerability

Stupid Simple CMS is a content management system for codelyfe individual developers. Stupid Simple CMS 1.2.4 and earlier versions have an authorization issue vulnerability that stems from the parameter file in the file /file-manager/delete.php that causes incorrect authentication...

IceCMS Authorization Issues Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation of NgShow individual developers. IceCMS 2.0.1 version of the authorization problem vulnerability , the vulnerability stems from the Article Handler component of the /article/DelectArticleById/ there...

Dell PowerEdge Server BIOS 访问控制错误漏洞

Dell PowerEdge Server BIOS is a system update driver for the Dell Dell of the United States. The Dell PowerEdge Server BIOS has an authorization issue vulnerability that stems from the inclusion of incorrect privilege management, which can be exploited by an unauthenticated, local attacker to cau...

PT-2023-9538 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle Process Manufacturing Product Development versions 12.2.13 through 12.2.14 Description: The issue is related to weaknesses in the authorization procedure of the Quality Manager Specification component in Oracle Process Manufacturing...

PT-2023-9578 · Oracle · Peoplesoft Enterprise Hcm Global Payroll Core

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise HCM Global Payroll Core versions 9.2.48 through 9.2.50 Description: The issue is related to weaknesses in the authorization mechanism of the Global Payroll for Core component. This can allow a remote attacker to gain...

PT-2023-9319 · Oracle · Oracle Applications Framework

Name of the Vulnerable Software and Affected Versions: Oracle Applications Framework versions 12.2.3 through 12.2.13 Description: The issue is related to improper authorization in the Personalization component of Oracle Applications Framework, part of the Oracle E-Business Suite. This can allow a...

PT-2023-9576 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to weaknesses in the authorization mechanism of the Auctions component in Oracle Sourcing, part of the Oracle E-Business Suite. This can allow a remote...