Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the Hono API course submission routing. Attackers can send their course ID along with the submission UUID of other courses as a request to the PUT o...

Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper authorization in PUT and DELETE requests for the /:lessonId route. Any course member including students can modify the title and stored HTML content of any course, or delete...

NivoCart authorization issue vulnerability

NivoCart 2.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization in the download operation for accounts/orders. Unauthenticated attackers can obtain guest order invoices by providing the orderid. By traversing the orderid...

ThinkCMF Authorization Issue Vulnerability

ThinkCMF 8.0.1 and earlier versions have an authorization issue. This vulnerability stems from improper authorization in the RestAdminBaseController. When there are no adminapi rules, the Auth::check validation fails, allowing restricted backend administrators to call all administrator REST API...

WordPress ACF Frontend Admin by DynamiApps: Permissions, licensing, and access control issues

The WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

Eclipse Jetty authorization issue vulnerability

Eclipse Jetty has an authorization issue vulnerability. This occurs when web.xml defines multiple url-patterns for a servlet, and security-constraint applies only to some of these url-patterns. In such cases, the Jakarta specification’s rules governing authoritative url-patterns are not enforced ...

zhontai Admin.Core Authorization Vulnerability

The zhontai Admin Core versions 10.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Attackers can provide record IDs that exceed the allowed range, bypassing DataScope’s restrictions. Attackers who possess user or...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions from 1.1.0 to 3.0.4, as well as 3.1.0, have security vulnerabilities. These vulnerabilities stem from the fact that the getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById GraphQL parsers have access without requiring...

AtalayaLabs OxiCloud Authorization Issue Vulnerability

The AtalayaLabs OxiCloud versions 0.9.1 to 0.9.3 have an authorization issue vulnerability. This vulnerability stems from improper authorization handling. Attackers can access shared files or folder contents by making a GET /api/files/id request, even after password protection has been applied...

QuadLayers Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization issue vulnerability

The Checkout Field Manager Checkout Manager in WooCommerce 7.9.6 and earlier versions has an authorization issue vulnerability. This vulnerability arises from the plugin’s failure to properly verify whether the user has the necessary permissions to perform certain operations. As a result,...

temporal.io Temporal Proxy Authorization Issue Vulnerability

In the versions of Temporal Proxy 0.2.0 to 0.8.0, there is an authorization issue. This issue arises from the failure to bind the encrypted payload to the namespace it belongs to at the time of encryption. As a result, the proxy selects the decryption key based on the identifier stored in the...

Eclipse Jetty authorization issue vulnerability

Versions 12.1.0 through 12.1.11 of Eclipse Jetty jetty-ee11-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee10-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee9-security, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

QNAP sMedio DTCP MOVE authorization issue vulnerability

Versions 1.4.x prior to QNAP sMedio DTCP MOVE 1.4.5 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing remote attackers to gain system access...

EnergizeLab FastAPI AI inference server authorization issue vulnerability

The EnergizeLab FastAPI AI inference server has a vulnerability related to authorization. This vulnerability arises from the lack of authentication for the AI model management function, which may allow unauthenticated remote attackers to modify the AI model configuration and switch the model that...

OpenSSH resource management error vulnerabilities

OpenSSH has a resource management vulnerability. This vulnerability arises when GSSAPI authentication is enabled, and after a failed GSSAPI attempt, the delegated credentials are not cleaned up properly. This may lead to incorrect authorization for subsequent logins...

WordPress PlanetStudio Payment Gateway Authorization Issue Vulnerability

WordPress PlanetStudio Payment Gateway 1.3.3 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization and improper configuration of access control security levels. It is possible for attackers to exploit this issue by using incorrectl...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions prior to 3.0.3 have an authorization issue vulnerability. This vulnerability stems from the getDocumentContent GraphQL query and the GET /api/documentapi/documentapi/document/documentId/content REST route, which do not check the document ownership or...

SUSE Rancher Authorization Issue Vulnerability

SUSE Rancher versions prior to 2.8.0, 2.10.0, 2.10.5, and 2.11.0/2.11.1 have an authorization issue. This issue arises because the namespace used by local clusters for storing related resources PRTBs and secrets is the project name itself. Users with permission to create projects can create...