CVE-2023-0583 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...

WordPress plugin VK Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-16383 · WordPress · Vk Blocks

Name of the Vulnerable Software and Affected Versions: VK Blocks plugin for WordPress versions up to, and including, 1.57.0.5 Description: The issue concerns improper authorization via the REST update options function. This allows authenticated attackers with contributor-level permissions or abov...

PT-2023-14905 · Sguda · Sguda U-Lock

Name of the Vulnerable Software and Affected Versions: SGUDA U-Lock central lock control service affected versions not specified Description: The issue is related to incorrect authorization in the user management function of the SGUDA U-Lock central lock control service. A remote attacker with...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in improper authorization, which allows attackers to disclose protected information.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to improper authentication. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Improper Authorization in "Customer automation rules" function

Description The product performs authorization checks incorrectly when an unauthorized actor tries to access a resource or perform an actions. Proof of Concept The user does not have permission to delete the rule. Location - GET /admin/customermanagementframework/rules/list - POST...

CVE-2023-2950

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950 Improper Authorization in openemr/openemr

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950

CVE-2023-2950 affects OpenEMR prior to 7.0.1 and is tied to improper authorization that enables an HTML-injection vulnerability through the patient portal API. Specifically, the PUT endpoint /openemr/portal/patient/api/onsitedocument/{id} accepts a fullDocument payload; a malicious user can modif...

PT-2023-5352 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.1 Description: The issue is related to improper authorization in the OpenEMR software, which can be exploited by a remote attacker to perform HTML injection. Recommendations: For versions prior to 7.0.1, update t...

Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

PT-2023-2907 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x Description: The issue is related to improper authorization in the Hitachi Vantara Pentaho Business Analytics Server. Exploitation of this...

Microsoft Windows Active Directory Certificate Services Improper Authorization Privilege Escalation Vulnerability

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of Microsoft Windows Active Directory Certificate Services. Authentication is required to exploit this vulnerability. The specific flaw exists within the issuance of certificates. By including...

CVE-2023-2782

Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure ACI before build 5.3.1-38...

CVE-2023-2782

Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure ACI before build 5.3.1-38...

CVE-2023-2782

CVE-2023-2782 (Acronis) : A vulnerability in Acronis Cyber Infrastructure (ACI) affects versions prior to 5.3.1-38, caused by improper authorization that enables disclosure of sensitive information. The affected component is the ACI platform itself (edge-focused infra solution). Exploitation deta...

CVE-2023-2782

Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure ACI before build 5.3.1-38...

CVE-2022-45450

Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent Linux, macOS, Windows before build 28610, Acronis Cyber Protect 15 Linux, macOS, Windows before build 30984...

CVE-2022-45450

Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent Linux, macOS, Windows before build 28610, Acronis Cyber Protect 15 Linux, macOS, Windows before build 30984...