CVE-2023-40730

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application lacks sufficient authorization checks. This could allow an attacker to access confidential information, perform administrative functions, or lead to a denial-of-service...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

Cisco Identity Services Engine 安全漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. Cisco Identity Services Engine suffers from an...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions have an authorization issue vulnerability that stems from incorrect authorization checks in SQLLab. An attacker can exploit the vulnerability to...

CVE-2023-4269

The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses...

WordPress plugin Profile Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability previously existed in the...

CVE-2023-2172

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeosupdatestepsajaxhandler, badgeosupdateawardstepsajaxhandler,...

The vulnerability of the Zabbix universal monitoring system, related to incorrect authorization, allows a intruder to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Zabbix universal monitoring system is related to the improper implementation of IP address checking. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and even cause service failures...

PT-2023-16356 · WordPress · Rest Api To Miniprogram

Name of the Vulnerable Software and Affected Versions: REST API TO MiniProgram WordPress plugin versions through 4.6.1 Description: The issue concerns a lack of authorization and CSRF checks in an AJAX action within the REST API TO MiniProgram WordPress plugin. This allows any authenticated users...

Mobileiron Sentry Authorization Issue Vulnerability

Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. An authorization issue vulnerability exists in Sentry versions 10.0.0 through prior to 23.7.2 that originates from a vulnerability that allows an attacker to retrieve valid access tokens from other users during an OAuth token...

Design/Logic Flaw

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an authorization issue vulnerability that stems from insufficient privilege checks in the Input Method module. An attacker can...

Matrix-appservice-bridge Authorization Issues Vulnerability

Matrix-appservice-bridge is an open source service. It is used to bridge application services for the Matrix communication program. Matrix-appservice-bridge suffers from an authorization issue vulnerability that stems from the fact that a malicious Matrix server can use an external user's MXID in...

EJBCA Authorization Issues Vulnerability

EJBCA is an open source Public Key Infrastructure PKI and Certificate Authority CA software from Keyfactor Open Source. A security vulnerability exists in Keyfactor EJBCA versions prior to 8.0.0 that stems from the presence of an authentication issue that results in the disclosure of CA...

Video Surveillance Management System 授权问题漏洞

Xiamen Four-Faith Communication Technology Video Surveillance Management System is a video surveillance management system developed by Xiamen Four-Faith Communication Technology Xiamen, China. Video Surveillance Management System is a video surveillance management system from Xiamen Four-Faith...

IBM Security Guardium 安全漏洞

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. An authorization issue vulnerability exists in IBM Security...

WAVLINK WL-WN531AX2 授权问题漏洞

The WAVLINK WL-WN531AX2 is a wireless router from the Chinese company WAVLINK. The WAVLINK WL-WN531AX2 suffers from an authorization issue vulnerability that stems from the presence of incorrect authentication issues, which can be exploited by an attacker to obtain a password for a wireless netwo...

SUSE CVE-2023-3114

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the sa...

CVE-2023-3114

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the sa...

CVE-2023-3114

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the sa...