Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the LocalStorage handler when manipulating the projectID argument. An attacker can gain unauthorized access to resources by providing a crafted value for this argument during local...

CVE-2012-10044 MobileCartly 1.0 savepage.php Arbitrary File Creation

MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...

K000152924: Apache HTTP Server vulnerability CVE-2024-43204

Security Advisory Description SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where modheaders is configured to modify the Content-Type request or response header with a valu...

CVE-2025-36023

IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key...

GHSA-XP75-R577-CVHP Privileged OpenBao Operator May Execute Code on the Underlying Host

Impact Under certain threat models, OpenBao operators with privileged API access may not be system administrators and thus normally lack the ability to update binaries or execute code on the system. Additionally, privileged API operators should be unable to perform TCP connections to arbitrary...

CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2025-50181: Pool managers now properly control redirects when retries is passed. bsc1244925 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

PT-2025-32362 · Ibm · Ibm Cloud Pak For Business Automation

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Business Automation versions 24.0.0 through 24.0.0 IF005 IBM Cloud Pak for Business Automation versions 24.0.1 through 24.0.1 IF002 Description: The software contains a flaw that may allow an authenticated user to view...

IBM Cloud Pak for Business Automation 安全漏洞

IBM Cloud Pak for Business Automation is an enterprise-class business process automation platform from IBM that provides intelligent document processing, workflow management and decision automation. A security vulnerability exists in IBM Cloud Pak for Business Automation that originates from a us...

GHSA-8QF3-X8V5-2PJ8 uv allows ZIP payload obfuscation through parsing differentials

Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP...

CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46387

CVE-2025-46387 describes an authorization bypass in Emby MediaBrowser (a media server) via a user-controlled key (CWE-639). The vulnerability is documented across multiple feeds (NVD/NVD-derived, CNVD, ENISA ENISA EUVD, CCTV-like references), consistently noting an authorization bypass mechanism ...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46386

CVE-2025-46386 corresponds to a CWE-639 authorization bypass via a user-controlled key. Connected sources identify the affected software as Emby MediaBrowser (and related mentions), noting that the issue enables bypassing authentication through manipulation of a user-controlled key. The Red Hat/C...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-32430

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute...