WordPress Strong Testimonials: Authorization Issue Vulnerability

WordPress versions 3.3.12 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit incorrectly configured access control levels...

WordPress Flexible Quantity Authorization Issue Vulnerability

WordPress versions 2.3.23 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

OpenHealthForAll OpenHealth Authorization Issues Vulnerability

OpenHealthForAll OpenHealth versions 0.2.0 and earlier have an authorization issue. This vulnerability stems from the GET, PATCH, and DELETE handlers at /api/health-data/id, which do not perform session or authorId checks when querying records by id. As a result, authentication and authorization...

Pig-mesh pig authorization issue vulnerability

The Pig-Mesh Pig version 4.1.1 and earlier have an authorization issue. This vulnerability stems from a lack of authorization verification in the SysUserController.user component. Any authenticated user can retrieve other users’ profiles via the GET /admin/user/details/id endpoint. Low-privilege...

WordPress PlanetStudio Payment Gateway Authorization Issue Vulnerability

WordPress PlanetStudio Payment Gateway 1.3.3 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization and improper configuration of access control security levels. It is possible for attackers to exploit this issue by using incorrectl...

CRMEB authorization issue vulnerabilities

The CRMEB version 5.6.1 to 6.0.0 contains an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the gift-order API. It allows authenticated store users to read and claim orders of other users. An attacker can enumerate consecutive order IDs in th...

DataElem BISHENG Authorization Issue Vulnerability

DataElem BISHENG 3.0.0-beta4 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references, which may allow authenticated low-privilege users to read other users’ parsed documents by providing arbitrary fileid values. It also allow...

Papermark authorization issue vulnerability

Papermark versions 0.22.0 and earlier have an authorization issue. This vulnerability stems from a lack of authorization verification in the data room viewer group API. It may allow authenticated users to send DELETE requests to delete viewership groups and share links for other teams, or to read...

Eclipse Jetty information leakage vulnerability

Eclipse Jetty 12.1.12 and earlier versions of 12.1.x, 12.0.38 and earlier versions of 12.0.x, 11.0.32 and earlier versions of 11.0.x, 10.0.32 and earlier versions of 10.0.x, and 9.4.64 and earlier versions of 9.4.x have a vulnerability involving information leakage. This vulnerability arises from...

Cole Medin Archon Authorization Issue Vulnerability

Cole Medin Archon versions 0.2.13 to 0.11.1 have an authorization issue vulnerability. This vulnerability stems from the lack of authentication. Unauthenticated attackers can access the control APIs bound to 0.0.0.0/api/, potentially allowing them to execute commands on the host as an Archon user...

Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper authorization in PUT and DELETE requests for the /:lessonId route. Any course member including students can modify the title and stored HTML content of any course, or delete...

NivoCart authorization issue vulnerability

NivoCart 2.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization in the download operation for accounts/orders. Unauthenticated attackers can obtain guest order invoices by providing the orderid. By traversing the orderid...

COOL cool-admin-midway Authorization Issue Vulnerability

COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue. This vulnerability stems from improper permission verification. An attacker with ordinary sys:role permissions can call the /admin/sys/role/info, update, or delete interfaces, allowing them to read, modify, or delete t...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has a security vulnerability. This vulnerability stems from the acceptance of user-controlled user IDs in account update requests during batch assignments. Registered users can set different identifier for other accounts and thereby take control of...

OpenSSH resource management error vulnerabilities

OpenSSH has a resource management vulnerability. This vulnerability arises when GSSAPI authentication is enabled, and after a failed GSSAPI attempt, the delegated credentials are not cleaned up properly. This may lead to incorrect authorization for subsequent logins...

EnergizeLab station-middleware authorization issue vulnerability

The EnergizeLab station-middleware versions 1.6.5 to 1.8.2 have authorization-related vulnerabilities. This issue arises from the management API not checking user roles, which may allow any authenticated, low-privilege user to obtain AI provider keys and alter configuration settings as well as...

HPE NonStop TCP/IP UTILITIES authorization issue vulnerability

The HPE NonStop TCP/IP UTILITIES T8602L01^BAA and earlier versions contain an authorization issue vulnerability. This vulnerability stems from a flaw in the finger daemon, potentially allowing unauthenticated remote attackers to cause a denial of service...

WordPress Knowledge Base: Authorization Issues Vulnerabilities

WordPress Knowledge Base 3.2.0 and earlier versions have a vulnerability related to authorization. This vulnerability stems from insufficient authorization settings, allowing attackers to exploit incorrect access control security levels to gain access...

Mindoc-org MinDoc licensing issues vulnerability

MinDoc 2.2-beta.2 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DocumentController.Content component. Certified attackers with non-observers roles can read Markdown and HTML documents in private books by...

NivoCart authorization issue vulnerability

NivoCart 2.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a CAPTCHA bypass mechanism. It is expected that CAPTCHAs are printed as plain text in HTML. Unverified attackers can access protected forms, extract the captchaimage value through pattern...