CVE-2023-0914

CVE-2023-0914 affects pixelfed/pixelfed versions prior to 0.11.4 due to improper authorization. Root cause is weak access control that could allow unauthorized access to content. Reported across multiple feeds (NVD/Red Hat/OSV/GHSA) with remediation guidance: update to 0.11.4 or later to resolve....

Pixelfed 安全漏洞

Pixelfed is a free and ethical photo sharing platform from the individual developers of Pixelfed. A security vulnerability exists in Pixelfed versions prior to 0.11.4 that stems from improper authorization...

CVE-2023-0822

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

CVE-2023-0822

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

Authorization

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

CVE-2023-0822 Improper Authorization

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

CVE-2023-0822 Improper Authorization

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

Privilege Escalation

github.com/argoproj/argo-cd is vulnerable to Privilege Escalation. An attacker with the ability to update at least one cluster secret is able to update any cluster secret due to an improper authorization bug, which allows the attackers to acquire elevated privileges or break Argo CD functionality...

PT-2023-6683

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Data Center and Server versions prior to 7.19.16, 8.3.4, 8.4.4, 8.5.3, and 8.6.1 Description Atlassian Confluence Data Center and Server are affected by an improper authorization vulnerability that allows an unauthenticate...

PT-2023-16550 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.03.001 Description: The issue concerns improper authorization in the affected product, which could allow an unauthorized user to bypass authorization and access privileged functionality. Recommendations: For...

Users with any cluster secret update access may update out-of-bounds cluster secrets

Impact All Argo CD versions starting with v2.3.0-rc1 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges potentially controlling...

Authorization

An improper authorization vulnerability CWE-285 in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...

CVE-2022-38375

CVE-2022-38375 affects Fortinet FortiNAC: versions 9.4.0 through 9.4.1 and prior to 9.2.6 expose an improper authorization flaw (CWE-285) that allows an unauthenticated attacker to perform administrative operations via crafted HTTP POST requests. Root cause is improper authorization leading to el...

CVE-2022-38375

An improper authorization vulnerability CWE-285 in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...

CVE-2022-38375

An improper authorization vulnerability CWE-285 in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...

CVE-2023-23947

Argo CD suffers an improper authorization vulnerability (CVE-2023-23947) affecting versions starting with 2.3.0-rc1 up to before 2.3.17, and including 2.4.23, 2.5.11, and 2.6.2. An attacker who can update at least one cluster secret can update any cluster secret, enabling privilege escalation or ...

CVE-2023-23947 Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to...

ArgoCD 安全漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

Fortinet FortiNAC 安全漏洞

Fortinet FortiNAC is a zero-trust access solution from Fortinet, Inc. A security vulnerability exists in Fortinet FortiNAC versions 9.4.0 through 9.4.1, prior to 9.2.6, which stems from improper authorization...

FortiNAC - Unauthenticated access to administrative operations

An improper authorization vulnerability CWE-285 in FortiNAC may allow an unauthenticated attacker to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...