PT-2022-23910

Name of the Vulnerable Software and Affected Versions Shinken Monitoring version 2.4.3 Description The issue is related to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nod...

PT-2022-25542 · Ocomon · Ocomon

Name of the Vulnerable Software and Affected Versions: OcoMon version 4.0RC1 Description: The issue is related to Incorrect Access Control. Through a request, a user can obtain the real email, and by sending the same request with the correct email, it is possible to perform an account takeover...

PT-2022-21757 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.8 through 15.2.5 GitLab CE/EE versions 15.3 through 15.3.4 GitLab CE/EE versions 15.4 through 15.4.1 Description: The issue is related to improper access control in the GitLab CE/EE API. This allows an unauthorized us...

CVE-2022-38388

IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access control. IBM X-Force ID: 233968...

CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

Cross site request forgery (csrf)

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

PT-2022-25045 · Facm · Facm

Name of the Vulnerable Software and Affected Versions: FACM application versions prior to SMR Oct-2022 Release 1 Description: The issue is related to improper access control in the FACM application, allowing a local attacker to connect arbitrary AP and Bluetooth devices. Recommendations: For...

CVE-2022-36634: Incorrect Authorization

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

PT-2022-23866 · Chipolo · Chipolo One Bluetooth Tracker +1

Name of the Vulnerable Software and Affected Versions: Chipolo ONE Bluetooth tracker 2020 version 4.13.0 Chipolo iOS app version 4.13.0 Description: The issue concerns Incorrect Access Control, allowing access revocation evasion attacks. Once a malicious sharee obtains access credentials, Chipolo...

PT-2022-7292 · Cri-O +2 · Cri-O +2

Name of the Vulnerable Software and Affected Versions: CRI-O affected versions not specified Description: The issue is related to the incorrect handling of supplementary groups in the CRI-O container engine, which may lead to sensitive information disclosure or possible data modification. This ca...

PT-2022-20040 · Cms8000 · Cms8000

Name of the Vulnerable Software and Affected Versions: CMS8000 affected versions not specified Description: The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard...

PT-2022-23655 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung pass versions prior to 4.0.03.1 Description: The issue is related to improper access control in Samsung pass, allowing physical attackers to access data on a certain state of an unlocked device. Recommendations: For versions prior to...

CVE-2022-32993: Undefined Security Weakness

TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh...

CVE-2022-36542

An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data...

PT-2022-23454

Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description An access control issue in the component /ip/admin/ allows attackers to arbitrarily edit, read, and delete Administrator data. Recommendations For Edoc-doctor-appointment-system version...

CVE-2022-36542: Undefined Security Weakness

An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data...

CVE-2022-26017

Improper access control in the IntelR DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2022-35122: Missing Authentication for Critical Function

An access control issue in Ecowitt GW1100 Series Weather Stations =GW1100Bv2.1.5 allows unauthenticated attackers to access sensitive information including device and local WiFi passwords...

Emerson Proficy Machine Edition 安全漏洞

Emerson Proficy Machine Edition is a software application from Emerson Electric USA, Inc. an automation solution. A security vulnerability exists in Emerson Proficy Machine Edition version 9.00 and prior versions, which stems from storing project data in a directory with incorrect access control...

PT-2022-19210 · Zoom · Zoom On-Premise Meeting Connector Mmr

Name of the Vulnerable Software and Affected Versions: Zoom On-Premise Meeting Connector MMR versions prior to 4.8.129.20220714 Description: The issue allows a malicious actor to join a meeting without appearing to other participants, admit themselves from the waiting room, become the host, and...