PT-2024-23076

Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...

PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt affected versions not specified Description: The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the...

CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inability to properly stop a loop...

CVE-2024-25811

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information...

CVE-2024-28735

Unit4 Financials by Coda versions prior to 2023Q4 are susceptible to an incorrect access control authorization bypass vulnerability. An authenticated user with a valid account—regardless of their profile—can modify the password of any other user in the application by sending a crafted POST reques...

PT-2024-2618 · NetGear · Netgear Cbr40 +1

Name of the Vulnerable Software and Affected Versions: Netgear CBR40 version 2.5.0.28 Netgear CBK40 version 2.5.0.28 Netgear CBK43 version 2.5.0.28 Description: The issue is related to an information leak in the currentsetting.htm component, which allows attackers to obtain sensitive information...

PT-2024-20679 · Unknown · Skysea Client View

Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2 Description: An improper access control issue exists in the resident process of SKYSEA Client View. This issue can be exploited to execute an arbitrary process with SYSTEM privileg...

CVE-2024-22889

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request...

CVE-2024-25811

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. This vulnerability stems from an Access Control Error within the content management system. No information regarding a patched version or specific remediation is currently provi...

CVE-2024-20325

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations o...

Authentication flaw

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

CVE-2023-47422

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

CVE-2023-47422

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

CVE-2023-27303

Improper access control in some IntelR ThunderboltTM DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2023-25073

Improper access control in some IntelR DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local access...

PT-2024-11056 · Meinberg · Meinberg Lantime-Firmware

Name of the Vulnerable Software and Affected Versions: Meinberg LANTIME-Firmware versions prior to 6.24.029 Meinberg LANTIME-Firmware versions 7 prior to 7.04.008 Description: An issue was discovered in the LTOS-Web-Interface of Meinberg LANTIME-Firmware, where an admin can delete required user...

SUSE-SU-2024:0315-1 Security update for slurm

This update for slurm fixes the following issues: - CVE-2023-49933: Fixed a message extension attack that could bypass the message hash bsc1218046. - CVE-2023-49936: Fixed a NULL pointer dereference bsc1218050. - CVE-2023-49937: Fixed a double free that could lead to denial of service or code...

ilgallorosso.it Improper Access Control vulnerability OBB-3840814

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-38141 WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8...