1600 matches found
CVE-2023-48775
Missing Authorization vulnerability in Gfazioli WP Cleanfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cleanfix: from n/a through 5.6.2...
Exploit for Improper Preservation of Permissions in Modernwms
Admin MD5 Password Hash Disclosure - ModernWMS v1.0 - CVE-2024...
CVE-2024-56031 WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability
Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through = 1.0.2...
CVE-2024-56067
CVE-2024-56067 affects the WordPress plugin WP SuperBackup (versions
CVE-2024-56219
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.6.1...
CVE-2024-56217
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through = 3.3.03...
CVE-2024-50703
TeamPass (open-source password manager) before version 3.1.3.1 is affected by CVE-2024-50703. The issue allows a user to act with the privileges of a different user_id due to improper prevention of privilege escalation. Affected component/condition: user-session/privilege checks in TeamPass prior...
CVE-2024-50945
An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submit reviews without verifying if they have purchased the product...
CVE-2024-39025
Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data...
CVE-2024-45805 OpenCTI leaks support information due to inadequate access control
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information SETTINGSSUPPORT. This is due to inadequate access control for support information...
BIT-RAILS-2024-26144 Possible Sensitive Session Information Leak in Active Storage
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain...
CVE-2021-26093
An access of uninitialized pointer CWE-824 vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command...
CVE-2024-49202
Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...
CVE-2024-49202
The Keyfactor Command PKI and machine identity automation application is affected by an Incorrect Access Control vulnerability (ID: 64099) in versions prior to 12.5.0 . The root cause is that access tokens are over permissioned , granting more permissions than intended. This flaw could allow unau...
CVE-2024-54662
The Dante proxy server (versions 1.4.0 through 1.4.3 ) contains a vulnerability due to incorrect access control in certain sockd.conf configurations involving the socksmethod parameter. This deficiency in the authentication mechanism allows a remote malicious actor to circumvent existing security...
BIT-MATTERMOST-2024-29221
Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...
PT-2024-36397
Name of the Vulnerable Software and Affected Versions Dante versions 1.4.0 through 1.4.3 Description The issue is related to incorrect access control for some sockd.conf configurations involving the socksmethod. This problem affects certain settings and can lead to unauthorized access...
CVE-2023-41695
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through = 5.1.0...
CVE-2023-41849
Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Like Dislike: from n/a through 1.1.0...