AZL-26300 CVE-2023-26463 affecting package strongswan for versions less than 5.9.10-1

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrust...

CVE-2023-29108 IP filter vulnerability in ABAP Platform and SAP Web Dispatcher

The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources...

PT-2023-19681 · Buffalo · Bs-Gs2008P +5

Name of the Vulnerable Software and Affected Versions: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier BS-GSL2016P firmware Ver. 1.10-0.03 and earlier BS-GSL2016 firmware Ver. 1.10-0.03 and earlier BS-GS2008 firmware Ver. 1.0.10.01 and earlier BS-GS2016 firmware Ver. 1.0.10.01 and earlier BS-GS202...

CVE-2023-28732 Missing access control affecting the AcyMailing plugin for Joomla

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plug...

PT-2023-21926 · Joomla · Anymailing Joomla Plugin

Name of the Vulnerable Software and Affected Versions: AnyMailing Joomla Plugin versions prior to 8.3.0 Description: The issue is related to missing access control in the AnyMailing Joomla Plugin, allowing unauthorized access to sensitive information and system files via path traversal. This occu...

PT-2023-18232 · Google +1 · Android 11 +4

Name of the Vulnerable Software and Affected Versions: MyFiles application versions prior to 12.2.09.0 in Android 11 MyFiles application versions prior to 13.1.03.501 in Android 12 MyFiles application versions prior to 14.1.03.0 in Android 13 Description: The issue is related to improper access...

CVE-2023-24468

Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2...

plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins...

PT-2023-16816 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2022.3.12 and below Description: The issue concerns improper access control in the secure messages feature, allowing an authenticated attacker with the message UUID to access the contained data. Recommendations: Fo...

CVE-2023-24093

An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password...

PT-2023-19397 · H3C · H3C A210-G

Name of the Vulnerable Software and Affected Versions: H3C A210-G version A210-GV100R005 Description: The issue is related to access control, allowing attackers to authenticate without a password. Recommendations: For H3C A210-G version A210-GV100R005, consider restricting access to the device...

CVE-2023-24320

An access control issue in Axcora POS 0gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors...

CVE-2022-34157

Improper access control in the IntelR FPGA SDK for OpenCLTM with IntelR QuartusR Prime Pro Edition software before version 22.1 may allow authenticated user to potentially enable escalation of privilege via local access...

JSA10361 - Pulse Connect Secure (PCS) ActiveX client vulnerability

This isn't an active SA and this edit is part of an article maintenance project. Ivanti 04/03/2024. A malicious web site could trick an PCS users to click a link exploiting a vulnerability present in the ActiveX component of the PCS client software When using Internet Explorer to access the PCS...

PT-2023-14986 · Dell · Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Wyse Management Suite versions 3.8 and below Description: The issue concerns improper access control, allowing a malicious admin user to disable or delete users under administration and unassigned admins for which the group admin is not...

PT-2023-18214 · Samsung · Samsung Cloud

Name of the Vulnerable Software and Affected Versions: Samsung Cloud versions prior to 5.3.0.32 Description: The issue is related to improper access control in Samsung Cloud, allowing local attackers to access information with Samsung Cloud's privilege via implicit intent. Recommendations: For...

PT-2023-18186 · Samsung · Secure Folder

Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to SMR Jan-2023 Release 1 Description: The issue is caused by an improper implementation logic in Secure Folder, which allows the Secure Folder container to remain unlocked under certain conditions. Recommendation...

WAVLINK WL-WN533A8 Access Control Issue Vulnerability

WAVLINK WL-WN533A8 is a router from China's RuiYin Technology WAVLINK. The WAVLINK WL-WN533A8 suffers from an Access Control Issue vulnerability that originates from improper access control in the component /cgi-bin/ExportLogs.sh, which can be exploited by an attacker to download configuration da...

CVE-2022-48164

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials...

CVE-2022-48164

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials...