Pen testing avionics under ED-203a

The aviation industry realised some time ago that taking a standard approach to the cyber security of its products was needed and that this was a specialist discipline. A family of documents was produced to help with this: ED-202A / DO-326A – what should be certified ED-203A / DO-356A – how these...

CVE-2025-25968

DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files...

CVE-2024-6696

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses reads and/or writes to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad becau...

Citrix Systems Secure Access 安全漏洞

Citrix Systems Secure Access is a secure access solution from Citrix Systems, Inc. A security vulnerability exists in Citrix Systems Secure Access that stems from improperly restricting application privileges. An attacker could read or modify sensitive data by exploiting the vulnerability...

CVE-2024-6696

Hitachi Vantara Pentaho Business Analytics Server exposes an authorization check flaw in the user console trash content across versions prior to 10.2.0.0 and 9.3.0.9 (including 8.3.x). The root cause is insufficient granularity in access controls (CWE-1220), allowing an attacker to bypass protect...

The vulnerability of Microsoft Edge relates to the redirection of URLs to unreliable websites when loading the login page, allowing attackers to circumvent existing security restrictions.

The vulnerability of Microsoft Edge relates to the redirection of URLs to unreliable websites when loading the login page. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions...

Improper Authorization

magento/community-edition and magento/project-community-edition are vulnerable to Improper Authorization. The vulnerability is due to insufficient access controls due to improper authorization enforcement, allowing an attacker to bypass security measures and escalate privileges, potentially leadi...

WordPress plugin Analytify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-26789

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...

CVE-2023-46694

Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckeditor file manager functionality...

CVE-2025-26789

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...

RupeeWeb 安全漏洞

Rupeeseed RupeeWeb is a state-of-the-art web-based trading platform from Rupeeseed India. RupeeWeb suffers from a security vulnerability that stems from insufficient API endpoint privilege controls, allowing an authenticated, remote attacker to modify information on other user accounts...

ABB Cylon FLXeon 9.3.4 Unauthenticated Dashboard Access

ABB Cylon FLXeon version 9.3.4 allows unauthenticated access to the Building Management System BMS or Building Automation System BAS dashboard. This exposes sensitive information, including system status, events, and alarms related to HVAC operations. Additionally, an attacker could manipulate...

CVE-2025-26789

CVE-2025-26789 affects Logpoint AgentX prior to 1.5.0. The root cause is inadequate access controls that allow li-admin users to access sensitive information about the AgentX Manager within a Logpoint deployment. Impact is limited to exposure of sensitive information (confidentiality), with no li...

CVE-2025-26789

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...

CVE-2025-26789

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...

PT-2025-7177 · Rupeeweb · Rupeeweb

Name of the Vulnerable Software and Affected Versions: RupeeWeb trading platform affected versions not specified Description: This issue exists due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation could allow an...

CVE-2024-34520

An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R10240, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls...

CVE-2024-34520

The CVE-2024-34520 issue affects the Mavenir SCE Application Provisioning Portal (PORTAL-LBS-R_1_0_24_0). The vulnerability is an authorization bypass in which an authenticated guest can perform unauthorized administrative actions (e.g., access to the create/add user functionality) by bypassing c...

Astra Linux – Vulnerability in bind9

A malicious client can send numerous DNS messages via TCP, potentially causing the server to become unstable during the attack. The server may recover after the attack stops. The use of ACLs will not mitigate this attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through...