9545 matches found
PT-2022-13386
Name of the Vulnerable Software and Affected Versions Amelia WordPress plugin version 1.0.46 and earlier Description The issue allows any customer to update other's bookings and retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it,...
GitLab 8.8.x - 9.5.10, 10.x - 10.1.5, 10.2.x - 10.2.5, 10.3.x - 10.3.3 Improper Authorization Vulnerability
GitLab is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; if...
CVE-2021-20290
An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a...
PT-2022-9177
Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description An improper authorization handling flaw was found, allowing an authenticated local attacker to access and delete limited resources, and also causing a denial of service on the server. The...
CVE-2021-20290: Incorrect Authorization
An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a...
Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure
The plugin does not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it. PoC Although the API only...
The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to improper authorization, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Magento Commerce development and management software platform is related to improper authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
Gogs < 0.12.5 Multiple Vulnerabilities
Gogs is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...
GHSA-RJMQ-6V55-4RJV Improper Authorization in org.cometd.oort
Impact Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's possibly sensitive data. By publishi...
Improper Authorization in org.cometd.oort
Impact Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's possibly sensitive data. By publishi...
CVE-2022-24721
CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...
PT-2022-16829
Name of the Vulnerable Software and Affected Versions CometD versions prior to 5.0.11, 6.0.6, and 7.0.6 Description CometD is a scalable comet implementation for web messaging. In versions prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, allowi...
CVE-2022-24721: Incorrect Authorization
CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...
Gitea < 1.16.4 Improper Authorization Vulnerability
Gitea is prone to an improper authorization vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...
Improper Authorization in Gogs
Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...
GHSA-MCG6-H362-CMQ5 Improper Authorization in cobbler
Impact If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places Web UI, CLI & XMLRPC-API. The same applies to user accounts with passwords set to be expired. Patches There is a patch for the latest...
CVE-2022-0860
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2...
PYSEC-2022-177
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2...