CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

Improper Authorization

Gitlab is vulnerable to Improper Authorization. It is possible for unauthorized users to view public project release descriptions via atom endpoint...

CVE-2023-50332

Improper authorization vulnerability exists in the User Management /admin/users page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention...

CVE-2023-50332

GROWI contains an improper authorization vulnerability (CVE-2023-50332) on the User Management page (/admin/users) that could allow a user to delete or suspend their own account in versions prior to 6.0.6. Root cause is an authorization flaw in the /admin/users endpoint. The issue is documented a...

Improper Authorization

gitlab is vulnerable to Improper Authorization. It is possible for a removed project member to write to protected branches by using deploy keys...

PT-2023-31532 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.6 Description: An improper authorization issue exists in the User Management page, specifically at the /admin/users endpoint. This issue can lead to unintended deletion or suspension of a user's account...

PT-2023-31799 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7 through 3.17.18 GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server...

Unauthorized Access

apache-superset is vulnerable to Unauthorized Access. The vulnerability is due to improper authorization checks. This flaw can be exploited by an attacker by creating a dashboard and adding charts to it. Consequently they become one of the owners of the charts, resulting in unauthorized write...

Atlassian Confluence Improper Authorization / Code Execution Exploit

This improper authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to the Confluence instance administrator. This...

CVE-2023-41673

An improper authorization vulnerability CWE-285 in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests...

Authorization

An improper authorization vulnerability CWE-285 in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests...

CVE-2023-41673

An improper authorization vulnerability CWE-285 in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests...

PT-2023-29449 · Ibm · Ibm I Access Client Solutions

Name of the Vulnerable Software and Affected Versions: IBM i Access Client Solutions versions 1.1.2 through 1.1.4 IBM i Access Client Solutions versions 1.1.4.3 through 1.1.9.3 Description: The issue allows an attacker to obtain a decryption key due to improper authority checks. Recommendations:...

Improper Authorization

Chromium is vulnerable to Improper Authorization. The vulnerability is due to improper implementation in Autofill functionlality. This allows an attacker to bypass Autofill restrictions via a crafted HTML page...

PT-2023-9567 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.24 Oracle Database Server versions 21.3 through 21.15 Oracle Database Server versions 23.4 through 23.5 Description: The issue is related to improper authorization in the Database Core Component...

PT-2023-9321 · Oracle · Oracle Trade Management +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to improper authorization in the GL Accounts component of Oracle Trade Management, allowing a low-privileged attacker with network access via HTTP to...

CVE-2023-42569

Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji...

Authorization

Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji...

CVE-2023-42569

Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji...

CVE-2023-42569

CVE-2023-42569 concerns an improper authorization verification in Samsung’s AR Emoji, prior to the SMR Dec-2023 Release 1. The issue allows an attacker to read sandbox data from AR Emoji. Affected: AR Emoji components on Samsung devices. Root cause: improper authorization verification. Impact: re...