The vulnerability of the BuildKit container building tool, related to incorrect authorization, allows a malicious actor to execute containers with elevated privileges.

The vulnerability of the BuildKit container-building software is related to improper authorization. Exploiting this vulnerability allows a remote attacker to execute containers with elevated privileges...

PT-2024-18735

Name of the Vulnerable Software and Affected Versions Samsung Internet versions prior to 24.0 Description The issue is related to an improper authorization verification vulnerability. This vulnerability allows physical attackers to access files downloaded in SecretMode without proper...

Improper Authorization

GitLab is vulnerable to Improper Authorization. The above vulnerability is caused due to improper authorization in GitLab. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project...

PT-2024-1518

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.12.5 Description The issue is related to improper authorization in BuildKit, allowing a remote attacker to run containers with elevated privileges. BuildKit provides APIs for running interactive containers based on...

Improper Authorization

openjdk21 is vulnerable to Improper Authorization. The vulnerability is due to an issue in the Compiler component, allowing an unauthenticated attacker with network access through multiple protocols to compromise the affected systems...

Server-Side Template Injection Vulnerability in Confluence Data Center and Server (CVE-2023-22527)

Introduction On January 16 2024, Atlassian issued a ​​significant alert on a critical Server-Side Template Injection SSTI vulnerability in Confluence Data Center and Server, identified as CVE-2023-22527. This issue found in older versions, poses a serious risk as it allows attackers without any...

Emerson Rosemount GC370XA, GC700XA, GC1500XA

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely Vendor : Emerson Equipment : Rosemount GC370XA, GC700XA, GC1500XA Vulnerabilities : Command Injection, Improper Authentication, Improper Authorization 2. RISK EVALUATION Successful exploitation of these vulnerabilities...

CVE-2024-23388

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

CVE-2024-23388

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

Authorization

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

CVE-2024-23388

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

CVE-2024-23388

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

CVE-2024-23388: Missing Authorization

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

PT-2024-19863 · Mercari · Mercari App For Android

Name of the Vulnerable Software and Affected Versions: Mercari App for Android versions prior to 5.78.0 Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary website via the vulnerable...

Improper Authorization

apache-airflow is vulnerable to Improper Authorization. The vulnerability is due to missing access control check while accessing DAG code. An authenticated user can access source code of DAG to which they don't have access to...

CVE-2024-23649: Improper Authorization

Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message...

PT-2024-10360 · Drupal · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.0.4 Description: The issue is related to improper authorization in Drupal Open Social, allowing the collection of data from common resource locations. This can potentially lead to unauthorized access to...

WordPress plugin WP User Profile Avatar security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability previously existed...

PT-2024-14944

Name of the Vulnerable Software and Affected Versions WP User Profile Avatar WordPress plugin version 1.0.0 and earlier Description The issue allows authors to delete and update arbitrary avatars due to improper authorization checks. Recommendations For WP User Profile Avatar WordPress plugin...

PT-2024-4053

Name of the Vulnerable Software and Affected Versions: FortiWebManager versions 6.0.2, 6.2.3 through 6.2.4, 6.3.0, 7.0.0 through 7.0.4, and 7.2.0 Description: The issue is related to improper authorization in FortiWebManager, which can allow an attacker to execute unauthorized code or commands vi...