Improper Authorization

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Improper Authorization due to improper validation of user permissions in the items.queries.php component. An attacker can gain unauthorized access to folders by exploiting the lack of prop...

Improper Authorization

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Improper Authorization due to improper authorization checks in the mailme operation of the mailHandler function. An attacker can escalate privileges and perform actions reserved for...

CVE-2020-9081

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. Vulnerability ID: HWPSIRT-2019-12144 This vulnerability has...

CVE-2020-9081

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. Vulnerability ID: HWPSIRT-2019-12144 This vulnerability has...

CVE-2020-9081

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. Vulnerability ID: HWPSIRT-2019-12144 This vulnerability has...

PT-2024-10859 · Huawei · Huawei Smartphone

Name of the Vulnerable Software and Affected Versions: Huawei smartphones affected versions not specified Description: The issue is related to an improper authorization vulnerability. An attacker could perform a series of operations in a specific mode to exploit this vulnerability, potentially...

CVE-2024-12901

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be...

CVE-2024-12901 FoxCMS API Endpoint Site.php improper authorization

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be...

CVE-2024-12901 FoxCMS API Endpoint Site.php improper authorization

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be...

CVE-2024-12901

FoxCMS up to version 1.2 is affected by a critical issue in the API Endpoint, specifically in /app/api/controller/Site.php, where manipulating the password argument leads to improper authorization. The vulnerability enables remote exploitation, and the exploit has been publicly disclosed. Multipl...

PT-2024-17789 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: FoxCMS versions up to 1.2 Description: A critical issue was found in the API Endpoint component, specifically in the file /app/api/controller/Site.php. The manipulation of the password argument leads to improper authorization, allowing for...

FoxCMS 安全漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS 1.2 and earlier versions, which originates from the parameter password in the file /app/api/controller/Site.php of the component API Endpoint that can lead...

CVE-2024-12782

A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.htmlhashHome of the component Web Interface. The manipulation leads to improper...

CVE-2024-12782 Fujifilm Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization

A vulnerability has been found in Fujifilm Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.htmlhashHome of the component Web Interface. The manipulation leads to improper authorization. The attack c...

CVE-2024-12782

The CVE-2024-12782 entry concerns Fujifilm Apeos C3070/C5570/C6580 Web Interface (unknown code in /home/index.html#hashHome). Affected versions go up to 24.8.28. The root cause is improper authorization in the Web Interface allowing remote initiation. Several sources confirm the vulnerability exi...

CVE-2024-12782 Fujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization

A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.htmlhashHome of the component Web Interface. The manipulation leads to improper...

Improper Authorization

apachesuperset is vulnerable to Improper Authorization. The vulnerability is due to the FABADDSECURITYAPI being enabled, allows lower-privileged users to access and use an API that should be restricted to higher-privileged users...

BIT-ELASTICSEARCH-2024-12539 Elasticsearch Incorrect Authorization

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow...

CVE-2024-11768 Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files

The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download...

PT-2024-13332 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home versions prior to 5.9 Description: The issue is related to an incorrect authorization vulnerability in the HTTP POST method in the Govee Home application on Android and iOS. This allows a remote attacker to control devices owned by...