CVE-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...

CVE-2022-28781

Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. The patch adds proper validation logic to check the caller...

CVE-2022-28790

Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic...

CVE-2022-28781

Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. The patch adds proper validation logic to check the caller...

CVE-2022-28790

Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic...

Authentication flaw

Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic...

CVE-2022-28790

Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic...

Wildfly 安全漏洞

Wildfly is a powerful, modular and lightweight application server from Wildfly. A security vulnerability exists in WildFly that stems from the fact that when Elytron Security is used, it returns the wrong caller body in certain highly concurrent scenarios...

CVE-2022-27332

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service DoS...

CVE-2022-27332

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service DoS...

CVE-2022-27332

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service DoS...

CVE-2022-27332

Summary (CVE-2022-27332): Zammad v5.0.3 contains an access control flaw that allows an unauthenticated attacker to write entries to the CTI caller log, enabling potential phishing attacks or DoS. Root cause: unauthorized access to the CTI logging pathway; impact: log manipulation, phishing, and s...

CVE-2022-27332

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service DoS...

CVE-2022-27332: Missing Authentication for Critical Function

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service DoS...

Zammad 访问控制错误漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version v5.0.3. An unauthenticated attacker could write entries to the CTI caller log...

PT-2022-18379 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.0.3 Description: An access control issue allows attackers to write entries to the CTI caller log without authentication. This can enable attackers to execute phishing attacks or cause a Denial of Service DoS. Recommendations:...

ASB-A-206492634

imsex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps No phone permissions can obtain some VoLTE sensitive information and manage VoLTE calls...

addVault and removeVault lack validation of caller address

Handle cccz Vulnerability details Impact The addVault and removeVault functions of the ConvexYieldWrapper contract lack validation of the caller address, allowing anyone to add or remove vaults from other addresses function addVaultbytes12 vaultId external address account =...

Design/Logic Flaw

Chang Lian application has a vulnerability which can be maliciously exploited to hide the calling number.Successful exploitation of this vulnerability allows you to make an anonymous call...

Missing access restriction on StabilityPool's receiveCollateral

Handle kenzo Vulnerability details StabilityPool's receiveCollateral should only be called by ActivePool, but that check is missing. Anybody can call it and update StabilityPool's total collateral variable. Impact Wrong amounts of total collateral in StabilityPool totalColl. As far as I can see,...