Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an information disclosure vulnerability that is caused by incorrect authorization validation on dashboard and chart imports. An attacker could use this vulnerability ...

CVE-2024-0855: Undefined Security Weakness

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the eventauthor parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+...

CVE-2024-0861 Direct Request ('Forced Browsing') in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the Guest role can change Custom dashboard projects settings contrary to permissions...

CVE-2024-0861 Direct Request ('Forced Browsing') in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the Guest role can change Custom dashboard projects settings contrary to permissions...

CVE-2024-1043: Improper Authorization

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppbremovesavedlayoutdata' function in all versions up to, and including, 1.0.93.1. This makes it possible for authenticated attackers, with...

Improper Authorization

com.hazelcast:hazelcast is vulnerable to Improper Authorization. The issue exists within the SQL mapping for the CSV File Source connector. The vulnerability is due to inadequate permission checking, allowing unauthorized clients to access data from files stored on a member's filesystem. Attacker...

CVE-2024-25635: Improper Authorization of Index Containing Sensitive Information

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may...

CVE-2024-20943: Improper Authorization

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge...

CVE-2024-21987: Improper Authorization

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings...

CVE-2024-1482 Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUBTOKEN. To exploit this vulnerability, an attacker would need access...

CVE-2023-38135

Improper authorization in some IntelR PM software may allow a privileged user to potentially enable escalation of privilege via local access...

Authorization

Improper authorization in some IntelR PM software may allow a privileged user to potentially enable escalation of privilege via local access...

Intel Performance Maximizer Security Vulnerability

Intel Performance Maximizer is a product from Intel Corporation that is used to automatically optimize the performance of systems supporting Intel processors. A security vulnerability exists in Intel Performance Maximizer that stems from an improper authorization issue in the affected product. It...

CVE-2023-38135: Improper Authorization

Improper authorization in some IntelR PM software may allow a privileged user to potentially enable escalation of privilege via local access...

Security Bulletin: Improper Authorization for IBM Jazz for Service Management export file via ExportServlet url (CVE-2023-46186)

Summary Improper Authorization for IBM Jazz for Service Management export file via ExportServlet url CVE-2023-46186 Vulnerability Details CVEID:CVE-2023-46186 DESCRIPTION: IBM Jazz for Service Management could allow an unauthorized user to obtain sensitive file information using forced browsing d...

PT-2024-1873 · Intel · Intel Pm

Name of the Vulnerable Software and Affected Versions: IntelR PM software affected versions not specified Description: The issue is related to improper authorization in some IntelR PM software, which may allow a privileged user to potentially enable escalation of privilege via local access. This...

CVE-2024-25108

Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...

Pixelfed Security Vulnerability

Pixelfed is a free and ethical photo sharing platform from the individual developers of Pixelfed. A security vulnerability exists in Pixelfed versions v0.10.4 through 0.11.11, which stems from an incorrect and insufficient authorization check for processing requests, which could allow an attacker...

Improper Authorization

DIRAC is vulnerable to Improper Authorization. The vulnerability is caused due to the TokenManager not checking permissions on cached tokens. This allows an attacker to use improperly cached tokens to gain access to resources, data, or functionalities within the DIRAC system for which they do not...

CVE-2023-43609 Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization

In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition...