CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

SonicWALL SMA100 Authorization Issues Vulnerability

The SonicWALL SMA100 is a security access gateway device from SonicWALL, Inc. An authorization issue vulnerability exists in SonicWALL SMA100 10.2.1.10-62SV and prior versions, which stems from the presence of an access control error vulnerability. An attacker could exploit the vulnerability to...

GitLab Authorization Issues Vulnerability

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. An authorization issue exists in GitLab where a user with the role of "Guest"...

Red Hat Keycloak Authorization Issues Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak suffers from an authorization issue vulnerability that stems from the presence of an authentication error vulnerability...

IBM Storage Scale Authorization Issues Vulnerability

IBM Storage Scale is a storage solution from International Business Machines IBM designed to help organizations efficiently manage and scale storage resources to meet growing data storage needs. An authorization issue vulnerability exists in IBM Storage Scale Container Native, which stems from a...

Mastodon Authorization Issues Vulnerability

Mastodon is an open source social networking server based on ActivityPub. Mastodon suffers from an authorization problem vulnerability that stems from an authorization problem vulnerability in OpenID Connect...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-25106

OpenObserve CVE-2024-25106 affects OpenObserve versions prior to 0.8.0. The issue is an Authorization flaw in the remove_user_from_org flow exposed at /api/{org_id}/users/{email_id}, allowing any authenticated organizational member to remove any other member (including Admin/Root), due to insuffi...

SonicWALL SonicOS 授权问题漏洞

SonicWALL SonicOS is a set of operating systems designed for SonicWall firewall appliances from SonicWALL, Inc. An authorization issue vulnerability exists in SonicWall SonicOS version 7.1.1-7040 that stems from incorrect authentication. A remote attacker could exploit the vulnerability by...

Apache Ozone 授权问题漏洞

Apache Ozone is a software application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. An authorization issue vulnerability exists in Apache Ozone versions 1.2.0 through 1.3.0, which stems from the presence of an incorrect authentication vulnerability...

Graylog 授权问题漏洞

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. Graylog has an authorization issue vulnerability that stems from the presence of a cookie injection vulnerability. A remote attacker coul...

authentik Authorization Issues Vulnerability

authentik is an open source identity provisioning application from authentik Open Source. An authorization issue vulnerability exists in Authentik versions prior to 2023.8.7 and 2023.10.7, which stems from a security issue in authentik's PKCE that allows an attacker to bypass the protections...

CVE-2023-6279 Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

Sichuan Yougou Technology KuERP License Issue Vulnerability

Sichuan Yougou Technology KuERP is an e-commerce platform from Sichuan Yougou Technology, a Chinese company. An authorization issue vulnerability exists in Sichuan Yougou Technology KuERP 1.0.4 and earlier versions, which stems from a security issue in the checklogin function of...

PT-2024-15575 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 14.0 through 16.6.5 GitLab versions 16.7 through 16.7.3 GitLab versions 16.8 through 16.8.0 Description: An authorization issue exists, allowing an unauthorized attacker to assign arbitrary users to merge requests MRs they...

Quarkus Authorization Issues Vulnerability

Quarkus is a cloud-native Linux container-first framework for writing Java applications. Quarkus has an authorization issue vulnerability that stems from not enforcing authorization for certain methods...

Authorization

Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5...

PT-2024-11504 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce WordPress plugin versions prior to 6.2.1 Description: The issue is related to a lack of proper authorization checks when deleting reviews. This could allow any authenticated users, such as subscribers, to delete arbitrary comments...

SAP LT Replication Server Authorization Issues Vulnerability

SAP LT Replication Server is a solution from SAP Germany. An authorization issue vulnerability exists in SAP LT Replication Server that stems from not performing required authorization checks. An attacker with elevated privileges could exploit the vulnerability to perform malicious actions,...