Dokploy authorization issue vulnerability

Dokploy versions 0.30.8 and earlier have an authorization issue vulnerability. This vulnerability stems from the port tRPC router not verifying the organization to which the target application belongs. As a result, cross-organizational authorization bypasses occur. Attackers can read, modify,...

WordPress Sunshine Photo Cart authorization issue vulnerability

WordPress Sunshine Photo Cart versions 3.7.4 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

zhontai Admin.Core Authorization Vulnerability

The zhontai Admin Core versions 10.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Attackers can provide record IDs that exceed the allowed range, bypassing DataScope’s restrictions. Attackers who possess user or...

ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions from 1.1.0 to 3.0.4, as well as 3.1.0, have security vulnerabilities. These vulnerabilities stem from the fact that the getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById GraphQL parsers have access without requiring...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue. This vulnerability stems from the lack of method-level authorization checks in the user management endpoint PUT /api/users/resetPwd. Additionally, in UserServiceImpl.resetPwd, there is no role-level or ownership verification. This coul...

La Suite Numérique La Suite Docs Authorization Issues Vulnerability

The digital Suite, Suite Docs 6.0.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Authorized attackers can bypass authorizations using a user-controlled key. They can use their own document’s resourceid to send POS...

Le RustDesk API authorization issue vulnerability

The Le RustDesk API versions 2.7 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism: unauthorized attackers only need to send a target device ID as a POST request to /api/sysinfo. This request can overwrite existing peer records,...

BeyondTrust Remote Support Authorization Issues Vulnerability

BeyondTrust Remote Support versions 26.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from internal components failing to properly verify the origin of the received messages, allowing attackers to execute file operations on the device...

AtalayaLabs OxiCloud Authorization Issue Vulnerability

The AtalayaLabs OxiCloud versions 0.9.1 to 0.9.3 have an authorization issue vulnerability. This vulnerability stems from improper authorization handling. Attackers can access shared files or folder contents by making a GET /api/files/id request, even after password protection has been applied...

Palo Alto Networks Idira Secrets Manager authorization issue vulnerability

Palo Alto Networks’ Idira Secrets Manager versions prior to 13.9.3 have an authorization issue vulnerability. This vulnerability stems from an authorization flaw that allows authenticated users with limited privileges to perform unauthorized actions on policy branches. This can lead to the...

QuadLayers Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization issue vulnerability

The Checkout Field Manager Checkout Manager in WooCommerce 7.9.6 and earlier versions has an authorization issue vulnerability. This vulnerability arises from the plugin’s failure to properly verify whether the user has the necessary permissions to perform certain operations. As a result,...

temporal.io Temporal Proxy Authorization Issue Vulnerability

In the versions of Temporal Proxy 0.2.0 to 0.8.0, there is an authorization issue. This issue arises from the failure to bind the encrypted payload to the namespace it belongs to at the time of encryption. As a result, the proxy selects the decryption key based on the identifier stored in the...

Peppermint Lab Ticket Management System authorization issue vulnerability

The Peppermint Lab Ticket Management System versions 0.5.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation; any authenticated user can create time entries and attachments under another user’s identity by providing their us...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

COOL cool-admin-midway Authorization Issue Vulnerability

COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper permission verification. An attacker with the 'sys:user:' permission can call the '/admin/sys/user/info', '/update', or '/delete' interfaces. By providing arbitrary...

EasySoft Zentaopms Authorization Issue Vulnerability

EasySoft ZentaOPMS versions 22.6 and earlier have an authorization vulnerability. This vulnerability stems from an authorization bypass in the action::editComment function. Certified users can read and modify comments on products and projects that they do not have access to by providing any actio...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

HPE NonStop TCP/IP UTILITIES authorization issue vulnerability

The HPE NonStop TCP/IP UTILITIES T8602L01^BAA and earlier versions contain an authorization issue vulnerability. This vulnerability stems from a flaw under certain conditions when performing traceroute, potentially allowing unauthenticated remote attackers to cause a denial of service...

QNAP sMedio DTCP MOVE authorization issue vulnerability

Versions 1.4.x prior to QNAP sMedio DTCP MOVE 1.4.5 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing remote attackers to gain system access...