NewStart CGSL MAIN 7.02 : sssd Vulnerability (NS-SA-2025-0194)

The remote NewStart CGSL host, running version MAIN 7.02, has sssd packages installed that are affected by a vulnerability: - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting ...

CVE-2025-7947

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7947

CVE-2025-7947 affects jshERP (up to version 3.5). The vulnerability targets an unknown function in the file /user/delete of the Account Handler, where argument ID manipulation leads to improper authorization. It is exploitable remotely and the exploit has been disclosed publicly. Multiple connect...

CVE-2025-7947 jshERP Account delete improper authorization

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7947 jshERP Account delete improper authorization

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

PT-2025-30364 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP versions prior to 3.5 Description: A critical issue exists in jshERP. The issue involves improper authorization due to the manipulation of the ID argument within an unknown function of the /user/delete file in the Account Handler...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Shenghua in China. A security vulnerability exists in jshERP 3.5 and earlier versions, which stems from improper authorization due to incorrect manipulation of the parameter ID in the file /user/delete...

CVE-2025-49746

Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network...

Growatt cloud service 安全漏洞

Growatt cloud service is an OSS management system from Growatt, a Chinese company. A security vulnerability exists in Growatt cloud service, which stems from improper authorization checking and could lead to elevation of privilege...

CVE-2025-49746

Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network...

Azure Machine Learning Elevation of Privilege Vulnerability

Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network...

CVE-2025-6993

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the getemaillogdetails AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied postid and retrieves the corresponding email log post content including the...

PT-2025-30067 · Microsoft · Azure Machine Learning

Name of the Vulnerable Software and Affected Versions: Azure Machine Learning affected versions not specified Description: Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information...

XWiki 1.8.1 < 14.10.22, 15.0-rc-1 < 15.10.12, 16.0.0-rc-1 < 16.4.3, 16.5.0-rc-1 < 16.7.0 Improper Authorization Vulnerability (GHSA-r5cr-xm48-97xp)

Xwiki is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

Improper Authorization

authentik is vulnerable to Improper Authorization. The vulnerability is due to missing session validation for single-use tokens in RAC endpoints, which allows an attacker to reuse a valid token from a shared URL to access another user’s session...

CVE-2025-6993

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the getemaillogdetails AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied postid and retrieves the corresponding email log post content including the...

The vulnerability of the Azure Auth component of the Vault Enterprise platform for archiving corporate information allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of Azure Auth component in the Vault Enterprise archiving platform relates to improper authorization. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server relates to improper authorization, allowing a perpetrator to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to improper authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions...

Adobe ColdFusion Improper Authorization Vulnerability

Adobe ColdFusion is a dynamic Web server platform maintained by Adobe. An improper authorization vulnerability exists in Adobe ColdFusion, which can be exploited by an attacker to submit a special request to bypass security restrictions and gain unauthorized access to the system...