Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the Hono API course submission routing. Attackers can send their course ID along with the submission UUID of other courses as a request to the PUT o...

Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper authorization in PUT and DELETE requests for the /:lessonId route. Any course member including students can modify the title and stored HTML content of any course, or delete...

NivoCart authorization issue vulnerability

NivoCart 2.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization in the download operation for accounts/orders. Unauthenticated attackers can obtain guest order invoices by providing the orderid. By traversing the orderid...

ThinkCMF Authorization Issue Vulnerability

ThinkCMF 8.0.1 and earlier versions have an authorization issue. This vulnerability stems from improper authorization in the RestAdminBaseController. When there are no adminapi rules, the Auth::check validation fails, allowing restricted backend administrators to call all administrator REST API...

WordPress ACF Frontend Admin by DynamiApps: Permissions, licensing, and access control issues

The WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

zhontai Admin.Core Authorization Vulnerability

The zhontai Admin Core versions 10.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Attackers can provide record IDs that exceed the allowed range, bypassing DataScope’s restrictions. Attackers who possess user or...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions from 1.1.0 to 3.0.4, as well as 3.1.0, have security vulnerabilities. These vulnerabilities stem from the fact that the getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById GraphQL parsers have access without requiring...

COOL cool-admin-midway Authorization Issue Vulnerability

COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue. This vulnerability stems from improper permission verification. An attacker with ordinary sys:role permissions can call the /admin/sys/role/info, update, or delete interfaces, allowing them to read, modify, or delete t...

DataElem BISHENG Authorization Issue Vulnerability

DataElem BISHENG 3.0.0-beta4 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references, which may allow authenticated low-privilege users to read other users’ parsed documents by providing arbitrary fileid values. It also allow...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

QNAP sMedio DTCP MOVE authorization issue vulnerability

Versions 1.4.x prior to QNAP sMedio DTCP MOVE 1.4.5 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing remote attackers to gain system access...

EnergizeLab FastAPI AI inference server authorization issue vulnerability

The EnergizeLab FastAPI AI inference server has a vulnerability related to authorization. This vulnerability arises from the lack of authentication for the AI model management function, which may allow unauthenticated remote attackers to modify the AI model configuration and switch the model that...

OpenSSH resource management error vulnerabilities

OpenSSH has a resource management vulnerability. This vulnerability arises when GSSAPI authentication is enabled, and after a failed GSSAPI attempt, the delegated credentials are not cleaned up properly. This may lead to incorrect authorization for subsequent logins...

WordPress PlanetStudio Payment Gateway Authorization Issue Vulnerability

WordPress PlanetStudio Payment Gateway 1.3.3 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization and improper configuration of access control security levels. It is possible for attackers to exploit this issue by using incorrectl...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions prior to 3.0.3 have an authorization issue vulnerability. This vulnerability stems from the getDocumentContent GraphQL query and the GET /api/documentapi/documentapi/document/documentId/content REST route, which do not check the document ownership or...

SUSE Rancher Authorization Issue Vulnerability

SUSE Rancher versions prior to 2.8.0, 2.10.0, 2.10.5, and 2.11.0/2.11.1 have an authorization issue. This issue arises because the namespace used by local clusters for storing related resources PRTBs and secrets is the project name itself. Users with permission to create projects can create...

Mettle sendportal-core Authorization Issue Vulnerability

Mettle sendportal-core 4.0.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass, allowing authenticated workspace members to attach subscribers to tags in other workspaces by providing unvalidated tag IDs. Attackers can submit...

Mitsubishi Electric GENESIS authorization issue vulnerability

Mitsubishi Electric GENESIS 11.03 and earlier versions, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX 10.97.3 and earlier versions, as well as MC Works64, GENESIS32, and BizViz, all have an authorization issue vulnerability. This vulnerability stems from a weak...

Metasfresh authorization issue vulnerability

Versions of Metasfresh 5.175 and earlier have an authorization issue. This vulnerability stems from the absence of record-level authorization in the BoardRestController. Low-privilege users, after being authenticated, can bypass role and organization access checks. They can call the getBoard,...

Eclipse Jetty authorization issue vulnerability

Versions 12.1.0 through 12.1.11 of Eclipse Jetty jetty-ee11-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee10-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee9-security, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of...