Mettle sendportal-core Authorization Issue Vulnerability

Mettle sendportal-core 4.0.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass, allowing authenticated workspace members to attach subscribers to tags in other workspaces by providing unvalidated tag IDs. Attackers can submit...

WordPress Blog2Social authorization issue vulnerability

WordPress Blog2Social versions 9.1.4 and earlier have a vulnerability related to authorization. This vulnerability stems from insecure direct object references. The AJAX handlers for b2sshipitem and b2sshipitemreloadurl do not perform object-based authorization on the postId parameter. As a resul...

Mitsubishi Electric GENESIS authorization issue vulnerability

Mitsubishi Electric GENESIS 11.03 and earlier versions, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX 10.97.3 and earlier versions, as well as MC Works64, GENESIS32, and BizViz, all have an authorization issue vulnerability. This vulnerability stems from a weak...

MagicBlack maccms10 authorization issue vulnerability

The magicblack maccms10 2026.1000.4056 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of restrictions on the number of attempts to recover the six-digit password code. This could allow unauthenticated attackers to brute-force the findpassres...

Eclipse Jetty authorization issue vulnerability

Eclipse Jetty has an authorization issue vulnerability. This vulnerability arises because a constraint defined as http-method-omission in the Jakarta specification can be bypassed by using substrings of predefined HTTP methods, potentially leading to circumvention of access control restrictions...

BeyondTrust Remote Support Authorization Issues Vulnerability

BeyondTrust Remote Support versions 26.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from internal components failing to properly verify the origin of the received messages, allowing attackers to execute file operations on the device...

WordPress Knowledge Base: Authorization Issues Vulnerabilities

WordPress Knowledge Base 3.2.0 and earlier versions have a vulnerability related to authorization. This vulnerability stems from insufficient authorization settings, allowing attackers to exploit incorrect access control security levels to gain access...

WordPress Strong Testimonials: Authorization Issue Vulnerability

WordPress versions 3.3.12 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit incorrectly configured access control levels...

COOL cool-admin-midway Authorization Issue Vulnerability

COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper permission verification. An attacker with the 'sys:user:' permission can call the '/admin/sys/user/info', '/update', or '/delete' interfaces. By providing arbitrary...

Mitsubishi Electric GENESIS authorization issue vulnerability

Mitsubishi Electric GENESIS 11.03 and earlier versions, GENESIS64 10.97.3 and earlier versions, ICONICS Suite 10.97.3 and earlier versions, Hyper Historian 10.97.3 and earlier versions, AnalytiX 10.97.3 and earlier versions, MobileHMI 10.97.3 and earlier versions, IoTWorX 10.97.3 and earlier...

Palo Alto Networks Idira Secrets Manager authorization issue vulnerability

Palo Alto Networks’ Idira Secrets Manager versions prior to 13.9.3 have an authorization issue vulnerability. This vulnerability stems from an authorization flaw that allows authenticated users with limited privileges to perform unauthorized actions on policy branches. This can lead to the...

Metasfresh authorization issue vulnerability

Versions of Metasfresh 5.175 and earlier have an authorization issue. This vulnerability stems from the absence of record-level authorization in the BoardRestController. Low-privilege users, after being authenticated, can bypass role and organization access checks. They can call the getBoard,...

Le RustDesk API authorization issue vulnerability

The Le RustDesk API versions 2.7 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism: unauthorized attackers only need to send a target device ID as a POST request to /api/sysinfo. This request can overwrite existing peer records,...

NivoCart authorization issue vulnerability

NivoCart 2.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a CAPTCHA bypass mechanism. It is expected that CAPTCHAs are printed as plain text in HTML. Unverified attackers can access protected forms, extract the captchaimage value through pattern...

NSquared Simply Schedule Appointments Authorization Issue Vulnerability

NSquared Simply Schedule Appointments 1.6.12.35 and earlier versions have an authorization issue vulnerability. This vulnerability arises due to a user-controllable key causing authorization bypasses. By exploiting improperly configured access control levels, insecure direct object references may...

La Suite Numérique La Suite Docs Authorization Issues Vulnerability

The digital Suite, Suite Docs 6.0.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Authorized attackers can bypass authorizations using a user-controlled key. They can use their own document’s resourceid to send POS...

WordPress Flexible Quantity Authorization Issue Vulnerability

WordPress versions 2.3.23 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

WordPress Sunshine Photo Cart authorization issue vulnerability

WordPress Sunshine Photo Cart versions 3.7.4 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue. This vulnerability stems from the lack of method-level authorization checks in the user management endpoint PUT /api/users/resetPwd. Additionally, in UserServiceImpl.resetPwd, there is no role-level or ownership verification. This coul...

ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...