Apache Traffic Server authorization issue vulnerability

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. versions 8.0.0 through 8.1.0 of Apache Traffic Server are vulnerable to an authorization issue that stems from incorrect authentication in the TLS source of the application. An attacker could...

Delta Electronics DIAEnergie Licensing Issue Vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.An authorization...

ImpressCMS licensing issue vulnerability

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to an authorization issue that could be exploited by an attacker to bypass the authentication process and gain unauthorized access...

Apache Traffic Server 授权问题漏洞

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. versions 8.0.0 through 8.1.0 of Apache Traffic Server are vulnerable to an authorization issue that stems from incorrect authentication in the TLS source of the application. An attacker could...

Delta Electronics DIAEnergie 安全漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.An authorization...

Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

The plugin does not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data PoC Make a booking to get a customer account Login via API and get access token: curl...

Veeam Backup&Replication 授权问题漏洞

Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. Veeam Backup&Replication suffers from an authorization issue vulnerability that can b...

CVE-2022-24721 Incorrect Authorization in org.cometd.oort

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...

Cobbler Licensing Issue Vulnerability (CNVD-2022-20579)

Cobbler is a network installation server suite that is primarily used to quickly set up Linux network installation environments.An authorization issue vulnerability exists in versions of Cobbler prior to 3.3.2, which stems from the presence of incorrect authorization in the application. An attack...

CVE-2021-24950 Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS

The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insightcustomizeroptionsimport available to any authenticated user, does not validate user input before passing it to unserialize, nor sanitise and escape it before outputting it in the response. ...

Samsung ApkInstaller licensing issue vulnerability

Samsung ApkInstaller is a tool from Samsung, a South Korean company, for installing Apk files from Android memory cards. It is used to install Apk files from Android memory cards.An authorization issue vulnerability exists in the dynamic receiver in Samsung ApkInstaller, which stems from a lack o...

Shopware Licensing Issue Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware suffers from an authorization issue vulnerability that stems from incorrect api routing checks. An attacker could exploit this vulnerability to modify customers and create orders without application...

Samsung ApkInstaller 安全漏洞

Samsung ApkInstaller is a tool from Samsung, a South Korean company, for installing Apk files from Android memory cards. It is used to install Apk files from Android memory cards.An authorization issue vulnerability exists in the dynamic receiver in Samsung ApkInstaller, which stems from a lack o...

Nextcloud server authorization issue vulnerability (CNVD-2022-20692)

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud server is a self-hosted system designed to provide cloud-style services. nextcloud server is vulnerable to an authorization issue that stems from a lack of...

Shopware 授权问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware suffers from an authorization issue vulnerability that stems from incorrect api routing checks. An attacker could exploit this vulnerability to modify customers and create orders without application...

ZOHO ManageEngine SharePoint Manager Plus Licensing Issue Vulnerability

ZOHO ManageEngine SharePoint Manager Plus is a complete management and auditing solution from ZOHO, Inc. An authorization issue vulnerability exists in versions prior to ZOHO ManageEngine SharePoint Manager Plus 4329, which stems from a network system or The vulnerability is caused by a lack of...

Webmin authorization issue vulnerability

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. an authorization issue vulnerability exists in versions of Webmin prior to 1.990, which stems from a lack of authentication measures or insufficient authentication strength in a networked...

Webmin 授权问题漏洞

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. an authorization issue vulnerability exists in versions of Webmin prior to 1.990, which stems from a lack of authentication measures or insufficient authentication strength in a networked...

PT-2022-9454 · WordPress · The Logo Showcase With Slick Slider

Name of the Vulnerable Software and Affected Versions: The Logo Showcase with Slick Slider WordPress plugin versions prior to 1.2.5 Description: The issue concerns a lack of CSRF and authorization checks in the lswss save attachment data AJAX action. This allows any authenticated user to modify...

PT-2022-9568 · WordPress · Maps Plugin Using Google Maps

Name of the Vulnerable Software and Affected Versions: Maps Plugin using Google Maps for WordPress versions prior to 1.8.1 Description: The issue concerns a lack of proper authorization and CSRF protection in most AJAX actions of the plugin, potentially allowing any authenticated user to delete...