2978 matches found
memos 授权问题漏洞
memos is an open source hosted memo center with knowledge management and social features. A vulnerability in authorization issues exists in versions prior to memos 0.9.1, which can be exploited by an attacker to view, update, and delete shortcuts of other users using IDOR...
PT-2022-7074 · WordPress · Login As User/Customer
Name of the Vulnerable Software and Affected Versions: Login as User or Customer WordPress plugin versions prior to 3.3 Description: The issue is related to insufficient authorization checks, which could allow unauthenticated attackers to obtain a valid admin session by logging in as another user...
memos 授权问题漏洞
memos is an open source hosted memo center with knowledge management and social features. A vulnerability in authorization issues exists in versions of memos prior to 0.9.0, which stems from incorrect authorization...
IBM Security Verify Governance 授权问题漏洞
IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define, and control user access and access risks. A security vulnerability exists in IBM Security Verify Governance, Identity...
CVE-2022-43872
IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information e.g. event log entries about the FTM SWIFT system. IBM X-Force ID: 239708...
Design/Logic Flaw
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations are not properly verified when accessing the project "homepage"/dashboards. Users not authorized to access a project may still be able to...
Nortek Control Linear eMerge E3-Series 授权问题漏洞
The Nortek Control Linear eMerge E3-Series is an access control from Nortek Control USA. It allows you to specify which doors a person can use to enter and exit a specified location at a specified time. An authorization issue vulnerability exists in several versions of the Nortek Control Linear...
CVE-2022-3946
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods...
CVE-2022-3882
The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.o...
CVE-2022-3883
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress....
PT-2022-24578 · WordPress · Wp Tools Increase Maximum Limits
Name of the Vulnerable Software and Affected Versions: WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin versions prior to 3.43 Description: The issue is related to improper authorization and CSRF in an AJAX...
openstack-barbican: Barbican allows anyone with an admin role to add their secrets to a different project's containers
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service...
openstack-barbican: Barbican allows authenticated users to add/modify/delete arbitrary metadata on any secret
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...
SiriusXM Vulnerability Lets Hackers Remotely Unlock and Start Connected Cars
Cybersecurity researchers have discovered a security vulnerability that exposes cars from Honda, Nissan, Infiniti, and Acura to remote attacks through a connected vehicle service provided by SiriusXM. The issue could be exploited to unlock, start, locate, and honk any car in an unauthorized manne...
BD BodyGuard 授权问题漏洞
BD BodyGuard is a series of small, lightweight, mobile infusion pumps from BD Medical USA. An authorization issue vulnerability exists in BD BodyGuard Pumps that stems from a lack of protection mechanisms for alternate hardware interfaces.The affected BD BodyGuard Infusion Pumps allow access via ...
CVE-2022-41930 org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users
org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user logged in or not with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attack...
Schneider Electric Modicon M340 安全漏洞
The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructures from Schneider Electric France. An authorization issue vulnerability exists in the Schneider Electric product that stems from the presence of improper privilege...
Atlassian Crowd 授权问题漏洞
Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multi-user, web applications and directory servers. Atlassian Crowd suffers from an authorization issue vulnerability that stems from the fact...