CVE-2025-3838 Improper Authorization in the installer for the EOL OVA based connect component

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed...

CVE-2025-3838

CVE-2025-3838 affects the EOL OVA based connect component used for installation in internal networks. The issue is improper authorization that could let an attacker access the local database containing weakly hashed installer credentials. CVSS 4.0 data indicate A: Adjacent, AC: High, PR: None, UI...

PT-2025-17445 · Dremio · Dremio

Name of the Vulnerable Software and Affected Versions: Dremio versions prior to 24.0.0 Dremio versions 24.3.0 through 24.3.16 Dremio versions 25.0.0 through 25.0.14 Dremio versions 25.1.0 through 25.1.7 Dremio versions 25.2.0 through 25.2.4 Description: An improper authorization issue in Dremio...

PT-2025-17431 · Unknown · Eol Ova Based Connect

Name of the Vulnerable Software and Affected Versions: EOL OVA based connect component affected versions not specified Description: An Improper Authorization issue was identified in the EOL OVA based connect component, which could allow unauthorized access to the local database containing weakly...

Saviynt EOL OVA（Saviynt End of Life OVA） 安全漏洞

Saviynt EOL OVA Saviynt End of Life OVA is a lifecycle component from Saviynt. A security vulnerability exists in Saviynt EOL OVA Saviynt End of Life OVA that stems from improper authorization and could result in unauthorized access to a local database...

CVE-2024-49808

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions...

CVE-2024-49808 IBM Sterling Connect:Direct Web Services improper authorization

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions...

CVE-2024-49808 IBM Sterling Connect:Direct Web Services improper authorization

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions...

CVE-2024-49808

CVE-2024-49808 concerns IBM Sterling Connect:Direct Web Services. The affected products are IBM Sterling Connect:Direct Web Services versions 6.1.0, 6.2.0, and 6.3.0. The root cause is improper authorization that allows an authenticated user to spoof the identity of another user, enabling bypass ...

IBM Sterling Connect:Direct Web Services 安全漏洞

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services versions 6.1.0, 6.2.0, and 6.3.0 that stems from improper authorization and could...

Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to improper authorizations (CVE-2024-49808)

Summary IBM Sterling Connect:Direct Web Services could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions. Vulnerability Details CVEID:CVE-2024-49808 DESCRIPTION: IBM Sterling Connect:Direct Web...

CVE-2025-39456 WordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Logger: from n/a through = 2.2...

CVE-2025-3587

A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public a...

CVE-2025-3569

A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ShiroConfig.java. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2025-3567

A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketInterceptor.java of the component Ticket Handler. The manipulation leads to improper...

CVE-2025-3564

A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teacher String Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3550

A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched...

CVE-2025-3537

A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely...

CVE-2025-3587

A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public a...

CVE-2025-3587 ZeroWdd/code-projects studentmanager getTeacherList improper authorization

A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public a...