1597 matches found
CVE-2022-48165
CVE-2022-48165 affects Wavlink WL-WN530H4 M30H4.V5030.210121; the vulnerable component is /cgi-bin/ExportLogs.sh, enabling unauthenticated access to download configuration data, log files, and admin credentials. The Connected documents corroborate improper access control and potential for unautho...
PT-2023-12289 · Kitecms · Kitecms
Name of the Vulnerable Software and Affected Versions: KiteCMS version 1.1 Description: An issue with access control in KiteCMS allows remote attackers to view sensitive information by manipulating the path in the application URL. Recommendations: For KiteCMS version 1.1, update to a version that...
CVE-2022-48165: Undefined Security Weakness
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials...
Improper access control
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system...
CVE-2022-48079
CVE-2022-48079 affects the Monnai aaPanel host system v1.5. The root cause is an access control issue that allows attackers to escalate privileges and execute arbitrary code by uploading a crafted PHP file to the system’s virtual host directory. The provided connected documents do not specify a p...
CVE-2022-48079
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system...
PT-2023-15565 · Monnai · Aapanel
Name of the Vulnerable Software and Affected Versions: Monnai aaPanel host system version 1.5 Description: The issue allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system. This is due to an access control...
CVE-2022-46967: Insufficiently Protected Credentials
An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /admin/DBbackup/ directory...
CVE-2022-43997
Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insufficiently protected handle to the A180AG.exe SYSTEM process with PROCESSALLACCESS rights...
CVE-2022-41505
An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value...
CVE-2022-41505
An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value...
PT-2023-33412 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.268 Description: The issue concerns a bounds check for sx controls in the ASoC: ops component. It was introduced in version v4.19.228 and fixed in version v4.19.268. The actual impact and attack plausibili...
CVE-2022-46463
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."...
PT-2023-14936
Name of the Vulnerable Software and Affected Versions Harbor versions 1.X.X through 2.5.3 Description An access control issue allows attackers to access public and private image repositories without authentication. The vendor states this behavior is documented as a feature. There is no informatio...
PT-2023-15144 · WordPress · Royal Elementor Addons
Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.3.59 Description: The issue is related to insufficient access control in the 'wpr final settings setup' AJAX action. This allows any authenticated user to finali...
PT-2023-18766 · Unknown · Librephotos
Name of the Vulnerable Software and Affected Versions: LibrePhotos versions prior to e19e539 Description: The issue is related to incorrect access control in the api/views/user.py file. This could potentially allow unauthorized access to certain features or data. Recommendations: For versions pri...
PT-2023-18538 · Flarum · Flarum
Name of the Vulnerable Software and Affected Versions: Flarum versions prior to 1.6.3 Description: The issue concerns the mentions feature provided by the flarum/mentions extension, which allows users to mention any post ID on the forum using a special syntax. This feature leaks the discussion ID...
PT-2022-6135 · Sap +1 · Sap Solution Manager +1
Name of the Vulnerable Software and Affected Versions: SAP Solution Manager Diagnostic Agent version 7.20 Description: The issue allows an authenticated attacker on a Windows system to access a file containing sensitive data, which can be used to access a configuration file containing credentials...
CVE-2022-44932
CVE-2022-44932 affects Tenda A18 (firmware v15.13.07.09). The issue is an access control flaw that permits unauthenticated remote attackers to access the Telnet service, exposing integrity (I) to High risk and confidentiality/availability impacts as per CVSS: I=High, others None. The available so...