6124 matches found
Improper Authorization in imran300/inventory
✍️ Description A designer user can delete any other users IDOR. 🕵️♂️ Proof of Concept go to this url when logging in as a Designer. localhost/inventory/users/deleteusers/10 and then you can see that a user with id 10 will be deleted. 💥 Impact This vulnerability is capable of delete any user...
GHSA-3X4C-PQ33-4W3Q Improper authorisation of members discloses room membership to non-members
Impact Unauthorised users can access the membership list of members, with their display names of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver tha...
Improper authorisation of members discloses room membership to non-members
Impact Unauthorised users can access the membership list of members, with their display names of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver tha...
CVE-2021-36029
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...
CVE-2021-36037
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure...
CVE-2021-36029
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...
Authorization
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...
CVE-2021-36029
Magento Commerce vulnerabilities (CVE-2021-36029) affect versions 2.4.2 and earlier, 2.4.2-p1 and earlier, and 2.3.7 and earlier. The issue is improper authorization that could allow an attacker with admin privileges to perform remote code execution. Connected advisories confirm this is a Magento...
CVE-2021-36029 Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...
CVE-2021-36037
CVE-2021-36037 affects Magento Commerce: Magento Commerce 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are impacted by an improper authorization vulnerability that could allow an authenticated attacker to obtain sensitive information disclosure . The issue is described in ...
CVE-2021-36232
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges...
CVE-2021-36232
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges...
CVE-2021-36232
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges...
Authorization
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges...
CVE-2021-36232
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges...
CVE-2021-36232
Technical details such as affected component, root cause, and remediation are not publicly available in the provided documents. Monitor for updates.
Johnson Controls Controlled Electronic Management Systems CEM Systems AC2000
1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Controlled Electronic Management Systems Ltd., a subsidiary of Johnson Controls Inc Equipment: CEM Systems AC2000 Vulnerability: Improper Authorization 2. RISK EVALUATION Under specific conditions,...
CVE-2021-22247
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...