1557 matches found
Lunary 授权问题漏洞
lunary is a production toolkit for LLM. An authorization issue vulnerability exists in lunary that arises from allowing unauthorized users to access and manipulate items within an organization that should not be accessible. No detailed vulnerability details are provided at this time...
CVE-2024-35311
Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control...
PT-2024-11604 · Intel · Intel Thunderbolt Dch Drivers
Name of the Vulnerable Software and Affected Versions: IntelR Thunderbolt driver software versions prior to 89 Description: The issue is related to improper access control in some IntelR Thunderbolt driver software, which may allow an authenticated user to potentially enable escalation of privile...
PT-2024-18765 · Unknown · Multitasking Framework
Name of the Vulnerable Software and Affected Versions: multitasking framework versions prior to SMR May-2024 Release 1 Description: The issue is related to improper access control in the multitasking framework, allowing physical attackers to access an unlocked screen for a period of time...
PT-2024-24124 · Unknown · Dolibarr Erp/Crm
Name of the Vulnerable Software and Affected Versions: Dolibarr ERP CRM versions 19.0.0 and before Description: The issue allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover. Thi...
PT-2024-23076
Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...
PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt
Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt affected versions not specified Description: The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the...
CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission
Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inability to properly stop a loop...
CVE-2024-25811
An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information...
CVE-2024-28735
Summary: CVE-2024-28735 affects Unit4 Financials by Coda prior to 2023Q4. An authenticated user can bypass access control to change any user’s password via a crafted request (PoC shows POST /coda/rest/session/password with fields including user, newPassword, and target username). Impact: password...
PT-2024-2618 · NetGear · Netgear Cbr40 +1
Name of the Vulnerable Software and Affected Versions: Netgear CBR40 version 2.5.0.28 Netgear CBK40 version 2.5.0.28 Netgear CBK43 version 2.5.0.28 Description: The issue is related to an information leak in the currentsetting.htm component, which allows attackers to obtain sensitive information...
PT-2024-20679 · Unknown · Skysea Client View
Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2 Description: An improper access control issue exists in the resident process of SKYSEA Client View. This issue can be exploited to execute an arbitrary process with SYSTEM privileg...
CVE-2024-22889
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request...
CVE-2024-25811
Dreamer CMS v4.0.1 contains an access control flaw that can allow attackers to download backup files and leak sensitive information. The issue is described across sources (including Red Hat and NVD records) as an access-control error affecting Dreamer CMS 4.0.1. There is no detailed root-cause br...
CVE-2024-20325
A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations o...
Authentication flaw
An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...
CVE-2023-47422
An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...
CVE-2023-47422
An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...