ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions from 1.1.0 to 3.0.4, as well as 3.1.0, have security vulnerabilities. These vulnerabilities stem from the fact that the getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById GraphQL parsers have access without requiring...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue. This vulnerability stems from the lack of method-level authorization checks in the user management endpoint PUT /api/users/resetPwd. Additionally, in UserServiceImpl.resetPwd, there is no role-level or ownership verification. This coul...

La Suite Numérique La Suite Docs Authorization Issues Vulnerability

The digital Suite, Suite Docs 6.0.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Authorized attackers can bypass authorizations using a user-controlled key. They can use their own document’s resourceid to send POS...

Le RustDesk API authorization issue vulnerability

The Le RustDesk API versions 2.7 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism: unauthorized attackers only need to send a target device ID as a POST request to /api/sysinfo. This request can overwrite existing peer records,...

BeyondTrust Remote Support Authorization Issues Vulnerability

BeyondTrust Remote Support versions 26.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from internal components failing to properly verify the origin of the received messages, allowing attackers to execute file operations on the device...

AtalayaLabs OxiCloud Authorization Issue Vulnerability

The AtalayaLabs OxiCloud versions 0.9.1 to 0.9.3 have an authorization issue vulnerability. This vulnerability stems from improper authorization handling. Attackers can access shared files or folder contents by making a GET /api/files/id request, even after password protection has been applied...

QuadLayers Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization issue vulnerability

The Checkout Field Manager Checkout Manager in WooCommerce 7.9.6 and earlier versions has an authorization issue vulnerability. This vulnerability arises from the plugin’s failure to properly verify whether the user has the necessary permissions to perform certain operations. As a result,...

temporal.io Temporal Proxy Authorization Issue Vulnerability

In the versions of Temporal Proxy 0.2.0 to 0.8.0, there is an authorization issue. This issue arises from the failure to bind the encrypted payload to the namespace it belongs to at the time of encryption. As a result, the proxy selects the decryption key based on the identifier stored in the...

Eclipse Jetty authorization issue vulnerability

Versions 12.1.0 through 12.1.11 of Eclipse Jetty jetty-ee11-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee10-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee9-security, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of...

Peppermint Lab Ticket Management System authorization issue vulnerability

The Peppermint Lab Ticket Management System versions 0.5.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation; any authenticated user can create time entries and attachments under another user’s identity by providing their us...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

COOL cool-admin-midway Authorization Issue Vulnerability

COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper permission verification. An attacker with the 'sys:user:' permission can call the '/admin/sys/user/info', '/update', or '/delete' interfaces. By providing arbitrary...

EasySoft Zentaopms Authorization Issue Vulnerability

EasySoft ZentaOPMS versions 22.6 and earlier have an authorization vulnerability. This vulnerability stems from an authorization bypass in the action::editComment function. Certified users can read and modify comments on products and projects that they do not have access to by providing any actio...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

QNAP sMedio DTCP MOVE authorization issue vulnerability

Versions 1.4.x prior to QNAP sMedio DTCP MOVE 1.4.5 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing remote attackers to gain system access...

Mitsubishi Electric GENESIS authorization issue vulnerability

Mitsubishi Electric GENESIS 11.03 and earlier versions, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX 10.97.3 and earlier versions, as well as MC Works64, GENESIS32, and BizViz, all have an authorization issue vulnerability. This vulnerability stems from a weak...

SUSE Rancher Authorization Issue Vulnerability

SUSE Rancher versions prior to 2.8.0, 2.10.0, 2.10.5, and 2.11.0/2.11.1 have an authorization issue. This issue arises because the namespace used by local clusters for storing related resources PRTBs and secrets is the project name itself. Users with permission to create projects can create...

Mitsubishi Electric GENESIS authorization issue vulnerability

Mitsubishi Electric GENESIS 11.03 and earlier versions, GENESIS64 10.97.3 and earlier versions, ICONICS Suite 10.97.3 and earlier versions, Hyper Historian 10.97.3 and earlier versions, AnalytiX 10.97.3 and earlier versions, MobileHMI 10.97.3 and earlier versions, IoTWorX 10.97.3 and earlier...

Chris Trudesk Authorization Issue Vulnerability

Chris Trudesk versions 1.2.11 and earlier have an authorization vulnerability. This vulnerability stems from an authorization bypass issue. The GET /api/v1/messages/conversation/:id endpoint lacks participant verification, allowing any authenticated user to access private conversations by providi...