Privilege Escalation

go is vulnerable to privilege escalation. The vulnerability exists due to a bypass access control that is based on IP addresses that when there are extra zero characters at the beginning of an IP address octet...

CVE-2021-36276

Dell DBUtilDrv2.sys driver versions 2.5 and 2.6 contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required...

FortiSandbox - Unauthorized user able to download the device configuration file.

An improper access control vulnerability CWE-284 in FortiSandbox may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL...

CVE-2021-22389

There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed...

Huawei Smartphone 安全漏洞

Huawei Emui is a mobile operating system developed on Android. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI is vulnerable to a privilege control vulnerability. An attacker can exploit the vulnerability to cause execution of certain code...

Atlassian JIRA Data Center 访问控制错误漏洞

Atlassian JIRA Data Center is the data center version of Atlassian JIRA from Atlassian Australia. An Access Control Error vulnerability exists in Jira Data Center due to a lack of authentication in the Ehcache RMI web service that listens on ports 40001 TCP and 40011 TCP.A remote, unauthenticated...

CVE-2021-31590

PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...

IBM Security Access Manager 权限许可和访问控制问题漏洞

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. IBM Security Access Manager Docker is vulnerable to a privilege permission and...

CVE-2021-25439

Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O8.1 and below, and 3.9.10.11 in Android P9.0 and above allows untrusted applications to cause arbitrary webpage loading in webview...

CVE-2021-25437

The CVE-2021-25437 issue affects Samsung Tizen’s FOTA service (prior to the firmware update JUL-2021 release). The root cause is an improper access control allowing an attacker to replace the FOTA update file, enabling arbitrary code execution. The vulnerability is described as exploitable over n...

CVE-2021-22368

There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device...

Zoho ManageEngine ServiceDesk Plus MSP Improper Access Control Vulnerability

Zoho ManageEngine ServiceDesk Plus MSP is a web-based ITSM suite designed for managed service providers. An improper access control vulnerability exists in versions prior to Zoho ManageEngine ServiceDesk Plus MSP 10521. An attacker could exploit the vulnerability to access internal data...

Command Execution Vulnerability in NoneCms (CNVD-2021-49167)

NoneCMS is a content management system CMS based on Thinkphp. A command execution vulnerability exists in NoneCms, which can be exploited by an attacker to gain control of the server...

Zammad Incorrect Access Control Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from a linked work order incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information...

Weidmueller Industrial WLAN devices Access Control Error Vulnerability

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. An access control error vulnerability exists in Weidmueller Industrial WLAN devices, which can be exploited by an attacker to cause remote shell access to the device as this user...

CVE-2021-28579 Adobe Connect improper access control could lead to privilege escalation

Adobe Connect version 11.2.1 and earlier is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker with 'Learner' permissions can leverage this scenario to access the list of event participants...

CVE-2021-21083 Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

VMware Carbon Black App Control 授权问题漏洞

Vmware VMware Carbon Black App Control is an application control product from Vmware USA. It is used to lock down servers and critical systems to prevent unwanted changes. An authorization issue vulnerability exists in VMware Carbon Black App Control 8.0, 8.1, 8.5 before 8.5.8, and 8.6 before...

WESEEK GROWI Access Control Error Vulnerability (CNVD-2021-43487)

Weseek GROWI is a suite of team collaboration software from Weseek Japan. An access control error vulnerability exists in WESEEK GROWI that originates from an error in the handling of authentication requests. A remote, authenticated attacker could exploit the vulnerability to view unauthorized...

Samsung Notes Incorrect Access Control Vulnerability

Samsung Notes is a Notes series of smartphone products from Samsung South Korea. An incorrect access control vulnerability exists in Samsung Notes, which can be exploited by an attacker to access local files...