CVE-2022-34112

CVE-2022-34112 describes an access-control flaw in DataEase v1.11.1 where non-admin users can arbitrarily uninstall the plugin via /api/plugin/uninstall. The issue’s root cause is improper permission checks on the uninstall endpoint, enabling privilege escalation to perform a destructive action. ...

CVE-2022-32430

An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application...

CVE-2022-34046

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

Design/Logic Flaw

An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data...

CVE-2022-34047

CVE-2022-34047 affects WAVLINK WN530HG4 (M30HG4.V5030.191116). The issue is an improper access control in the set_safety.shtml?r=52300 endpoint, where an attacker can view the page source (view-source:) and search for var syspasswd to obtain usernames and passwords. Evidence in connected docs not...

CVE-2022-24689

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages including personal data without being authenticated. The collected information includes the badge numbers that operate as user login...

Microsoft Azure Site Recovery 权限许可和访问控制问题漏洞

Microsoft Azure Site Recovery is a site recovery DRaaS from the U.S. company Microsoft for cloud and hybrid cloud architectures. Microsoft Azure Site Recovery elevation of privilege vulnerability can be exploited by attackers to gain elevated privileges on the system...

Microsoft Azure Site Recovery 权限许可和访问控制问题漏洞

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation USA. Microsoft Azure Site Recovery has an elevation of privilege vulnerability, and no details of the vulnerability are available...

CVE-2022-32290

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...

Firejail 权限许可和访问控制问题漏洞

Firejail is a SUID sandbox program written in C. A security vulnerability exists in Firejail version 0.9.68, which can be exploited by an attacker to gain root privileges...

CVE-2022-29633

An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie...

Tableau Server 安全漏洞

Tableau Server is a world-leading analytics platform from Tableau Inc. A security vulnerability exists in Tableau Server versions 2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4, and earlier versions, which stems from an access control issue with the application. An attacker could exploit the...

CVE-2022-29646

An access control issue in TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 allows attackers to obtain sensitive information via a crafted web request...

Design/Logic Flaw

An access control issue in TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 allows attackers to obtain sensitive information via a crafted web request...

Improper access control

An access control issue in D-Link DIR816LFW206b01 allows unauthenticated attackers to access folders folderview.php and categoryview.php...

CVE-2022-1753 WoWonder Group requests.php access control

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...

GHSA-43CM-73PX-5V4M OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

The "create an instance" API in OpenStack Compute Nova Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:ispublic property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for...

GHSA-8Q8V-28RM-QW4W Borg Improper Access Control vulnerability

Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3...

Microsoft Windows Print Spooler Components 权限许可和访问控制问题漏洞

Microsoft Windows Print Spooler Components is a printing backend handler component from Microsoft Corporation USA. A vulnerability exists in Microsoft Windows Print Spooler Components due to privilege permission and access control issues. The following products and editions are affected: Windows ...

Sandboxie Classic 安全漏洞

Sandboxie Classic is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. A security vulnerability exists in Sandboxie Classic version 5.55.13 that stems from the presence of an incorrect access control issue. An attacker could exploit the vulnerability to...