CVE-2025-27696

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue...

PT-2025-17602

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description The issue involves a high-severity fix, likely related to authentication bypass or remote code execution, though the exact impact is undisclosed. There is no information provided about the...

CVE-2024-46671

An Incorrect User Management vulnerability CWE-286 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard...

CVE-2024-46671

An Incorrect User Management vulnerability CWE-286 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard...

CVE-2024-46671

An Incorrect User Management vulnerability CWE-286 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard...

CVE-2024-46671

An Incorrect User Management vulnerability CWE-286 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard...

CVE-2024-47770 Ability to view Agent list with no privilege access in wazuh-dashboard

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. This vulnerability occurs when the system has weak privilege access, that allows an...

PT-2025-2774 · Wazuh +1 · Wazuh +1

Name of the Vulnerable Software and Affected Versions: Wazuh versions prior to 4.9.1 Description: This issue occurs when the system has weak privilege access, allowing an attacker to perform privilege escalation. As a result, an attacker can view the agent list on the Wazuh dashboard without...

IBM Sterling B2B Integrator Man-in-the-Middle

The vulnerability of the dashboard interface of the IBM Sterling B2B Integrator software lies in the ability to access the channel from a non-endpoint location. Exploiting this vulnerability allows an attacker operating remotely to execute a “man-in-the-middle” type attack...

CVE-2024-53245

In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard...

CVE-2024-53245

CVE-2024-53245 affects Splunk Enterprise and Splunk Cloud Platform where a low-privilege user whose username matches a role with read access to dashboards can clone a dashboard and view its name and XML. Affected versions are Splunk Enterprise < 9.3.0, < 9.2.4, and < 9.1.7, and Splunk Cl...

CVE-2024-53245 Information Disclosure due to Username Collision with a Role that has the same Name as the User

In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard...

Splunk Enterprise 9.1.0 < 9.1.7, 9.2.0 < 9.2.4 (SVD-2024-1203)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1203 advisory. - In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a...

PT-2024-10429 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.1 Description: The issue is related to the dashboard UI of IBM Sterling B2B Integrator, where an authenticated user could...

CVE-2021-27700: Authorization Bypass Through User-Controlled Key

SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc...

PT-2024-38703 · 3Dswymer +1 · 3Dswymer +1

Name of the Vulnerable Software and Affected Versions: 3DSwymer versions 3DEXPERIENCE R2023x through 3DEXPERIENCE R2024x Description: A stored Cross-site Scripting XSS vulnerability affects 3DDashboard in 3DSwymer, allowing an attacker to execute arbitrary script code in a user's browser session...

PT-2024-27043 · Zohocorp Manageengine · Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8000 Description: The issue is related to an authenticated SQL injection in the dashboard of ADAudit Plus. This vulnerability is distinct from another issue affecting the same dashboard...

CVE-2024-40480

A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthenticated attackers to view administrator dashboard and delete valid user accounts via the direct URL access...

PT-2024-27168 · Mapos · Mapos

Name of the Vulnerable Software and Affected Versions: MAP-OS versions 4.45.0 and earlier Description: The issue allows malicious users to insert a malicious payload into the Client Name input, resulting in unauthorized script execution on the administrator and employee dashboards when a service...

PT-2024-31719

Name of the Vulnerable Software and Affected Versions: ShopLentor plugin for WordPress versions up to, and including, 2.8.8 Description: The issue is related to a missing capability check on the ajax dismiss function, which allows authenticated attackers with contributor-level access and above to...