Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization through the security policies such as allowed-gadgets, disallow-pulling, and verify-image. An attacker can bypass these security measures by possessing the correct TLS certificates or having access to the Kubernet...

Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to improper authorization. The vulnerability is due to insufficient permission validation for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts created by the Playbooks bot...

CVE-2025-3918

The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the registeraction function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $POST'userrole' and passes it directly to wpinsertuser without...

CVE-2025-3918

CVE-2025-3918 affects the WordPress plugin Job Listings (versions 0.1–0.1.1). The register_action() handler reads client-supplied $_POST['user_role'] and passes it directly to wp_insert_user() without restricting to valid roles, enabling unauthenticated privilege escalation to administrator. Publ...

CVE-2025-4136

A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the HandleScim function. An attacker can bypass authorization controls by manipulating the SCIM User Creation Endpoint. Remediation Upgrade github.com/casdoor/casdoor/controllers to version 1.812.0 or higher...

CVE-2025-30392

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-30390

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network...

CVE-2025-30389

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system from Grokability Open Source. A security vulnerability exists in Snipe-IT versions prior to 8.1.0 that stems from improper authorization to access asset information...

The vulnerability of iOS and iPadOS operating systems, related to incorrect authorization, allows attackers to disclose sensitive information.

The vulnerability of iOS and iPadOS operating systems is related to improper authorization. Exploiting this vulnerability can allow attackers to disclose protected information...

CVE-2025-4136

A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-4136

Weitong Mall 1.0.0 is affected in the Sale Endpoint where manipulation of the ID argument leads to improper authorization. The issue can be exploited remotely and exploits have been disclosed publicly. Public sources (including PT-2025-18321) suggest a temporary workaround: restrict access to the...

CVE-2025-4136 Weitong Mall Sale Endpoint improper authorization

A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-4136 Weitong Mall Sale Endpoint improper authorization

A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-30389

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-30392

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-30390

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network...

CVE-2025-30389

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-30392

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...