GHSA-MRQX-MJC4-VFH3 wallabag subject to Improper Authorization via annotations

Impact The annotations feature lets users add annotations on highlighted parts of an entry. The controller does not validate authorization on PUT and DELETE requests which lets a logged user modify or delete any annotation using their ID on their endpoints example.org/annotations/id. These...

wallabag contains Improper Authorization via export feature

Description The export feature lets a user export a single entry or a set of entries in a given format e.g. PDF, MOBI, TXT. For example, https://yourinstance.wallabag.org/export/45.pdf will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an...

Improper Authorization

wallabag/wallabag is vulnerable to Improper Authorization. A remote attacker is able to gain access to unauthorized annotations from other users due to insecure direct object references which is made possible because of improper validation of the user permissions...

Improper Authorization

wallabag/wallabag is vulnerable to Improper Authorization. A remote attacker is able to gain access to unauthorized projects from other users due to insecure direct object references which is made possible because of improper validation of the user permissions...

GHSA-H45F-RJVW-2RV2 Withdrawn: wallabag subject to Improper Authorization

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-qwx8-mxxx-mg96. This link is maintained to preserve external references. Original Description Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

GHSA-XRW3-WQPH-3FXG Withdrawn: wallabag subject to Improper Authorization via annotations

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-mrqx-mjc4-vfh3. This link is maintained to preserve external references. Original Description Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0609

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0610

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

Authorization

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2022-4062

A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application. Affected Products: EcoStruxure Power Commission Versions prior to V2.25...

CVE-2022-4062

A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application. Affected Products: EcoStruxure Power Commission Versions prior to V2.25...

Authorization

A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application. Affected Products: EcoStruxure Power Commission Versions prior to V2.25...

CVE-2023-0609 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2022-4062

A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application. Affected Products: EcoStruxure Power Commission Versions prior to V2.25...

CVE-2023-0610 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0609

wallabag prior to 2.5.3 contains an Improper Authorization vulnerability via the export feature that allows insecure direct object reference (IDOR) to view other users’ entries. Root cause: missing ownership validation in the export/download path (exportEntry). Impact: potential exposure of user ...

PT-2023-16399 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.5.3 Description: The issue concerns an improper authorization vulnerability in the wallabag GitHub repository. It affects the export feature, which allows users to export entries in various formats, such as PDF,...

CVE-2022-4062

The CVE-2022-4062 issue affects Schneider Electric EcoStruxure Power Commission prior to V2.25. It is a CWE-285 improper authorization vulnerability that could allow unauthorized access to certain software functions when an attacker gains access to the localhost interface. Impact is described as ...

Apache IoTDB 安全漏洞

Apache IoTDB is an integrated data management engine designed for time series data from the Apache USA Foundation that provides data collection, storage, and analysis services, among other things. A security vulnerability exists in Apache IoTDB version 0.13.0 through versions prior to 0.13.3, whi...

PT-2023-1267 · Dompdf +1 · Dompdf +1

Name of the Vulnerable Software and Affected Versions: Dompdf version 2.0.1 Dompdf versions prior to 8.0.0 Description: The issue is related to the incorrect order of authorization checks before syntax analysis and canonization when processing tags with uppercase letters in SVG parsing. This can...