Mitsubishi Electric GENESIS authorization issue vulnerability

Mitsubishi Electric GENESIS 11.03 and earlier versions, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX 10.97.3 and earlier versions, as well as MC Works64, GENESIS32, and BizViz, all have an authorization issue vulnerability. This vulnerability stems from a weak...

Metasfresh authorization issue vulnerability

Versions of Metasfresh 5.175 and earlier have an authorization issue. This vulnerability stems from the absence of record-level authorization in the BoardRestController. Low-privilege users, after being authenticated, can bypass role and organization access checks. They can call the getBoard,...

Eclipse Jetty authorization issue vulnerability

Versions 12.1.0 through 12.1.11 of Eclipse Jetty jetty-ee11-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee10-servlet, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of jetty-ee9-security, versions 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 of...

COOL cool-admin-midway Authorization Issue Vulnerability

COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper permission verification. An attacker with the 'sys:user:' permission can call the '/admin/sys/user/info', '/update', or '/delete' interfaces. By providing arbitrary...

Eclipse Jetty authorization issue vulnerability

Eclipse Jetty has an authorization issue vulnerability. This vulnerability arises because a constraint defined as http-method-omission in the Jakarta specification can be bypassed by using substrings of predefined HTTP methods, potentially leading to circumvention of access control restrictions...

WordPress Knowledge Base: Authorization Issues Vulnerabilities

WordPress Knowledge Base 3.2.0 and earlier versions have a vulnerability related to authorization. This vulnerability stems from insufficient authorization settings, allowing attackers to exploit incorrect access control security levels to gain access...

WordPress Strong Testimonials: Authorization Issue Vulnerability

WordPress versions 3.3.12 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit incorrectly configured access control levels...

OpenHealthForAll OpenHealth Authorization Issues Vulnerability

OpenHealthForAll OpenHealth versions 0.2.0 and earlier have an authorization issue. This vulnerability stems from the GET, PATCH, and DELETE handlers at /api/health-data/id, which do not perform session or authorId checks when querying records by id. As a result, authentication and authorization...

WordPress AI Engine Authorization Issue Vulnerability

WordPress AI Engine versions 3.8.3 and earlier have a licensing issue vulnerability. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

WordPress PlanetStudio Payment Gateway Authorization Issue Vulnerability

WordPress PlanetStudio Payment Gateway 1.3.3 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization and improper configuration of access control security levels. It is possible for attackers to exploit this issue by using incorrectl...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has a security vulnerability. This vulnerability stems from the acceptance of user-controlled user IDs in account update requests during batch assignments. Registered users can set different identifier for other accounts and thereby take control of...

temporal.io Temporal Proxy Authorization Issue Vulnerability

In the versions of Temporal Proxy 0.2.0 to 0.8.0, there is an authorization issue. This issue arises from the failure to bind the encrypted payload to the namespace it belongs to at the time of encryption. As a result, the proxy selects the decryption key based on the identifier stored in the...

CRMEB authorization issue vulnerabilities

The CRMEB version 5.6.1 to 6.0.0 contains an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the gift-order API. It allows authenticated store users to read and claim orders of other users. An attacker can enumerate consecutive order IDs in th...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions from 1.1.0 to 3.0.4, as well as 3.1.0, have security vulnerabilities. These vulnerabilities stem from the fact that the getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById GraphQL parsers have access without requiring...

BeyondTrust Remote Support Authorization Issues Vulnerability

BeyondTrust Remote Support versions 26.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from internal components failing to properly verify the origin of the received messages, allowing attackers to execute file operations on the device...

Papermark authorization issue vulnerability

Papermark versions 0.22.0 and earlier have an authorization issue. This vulnerability stems from a lack of authorization verification in the data room viewer group API. It may allow authenticated users to send DELETE requests to delete viewership groups and share links for other teams, or to read...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

DataElem BISHENG Authorization Issue Vulnerability

DataElem BISHENG 3.0.0-beta4 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references, which may allow authenticated low-privilege users to read other users’ parsed documents by providing arbitrary fileid values. It also allow...

HPE NonStop TCP/IP UTILITIES authorization issue vulnerability

The HPE NonStop TCP/IP UTILITIES T8602L01^BAA and earlier versions contain an authorization issue vulnerability. This vulnerability stems from a flaw in the finger daemon, potentially allowing unauthenticated remote attackers to cause a denial of service...

ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...