CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...

CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...

CVE-2021-32584

An improper access control CWE-284 vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0 that stems from improper access control and could lead to elevated privileges...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0, which stems from improper access control and could lead to teachers signing in with each other...

SolarWinds Service Desk 安全漏洞

SolarWinds Service Desk is a powerful and affordable IT service management software from SolarWinds, Inc. It is used for IT service management. A security vulnerability exists in SolarWinds Service Desk that stems from improper access control and could lead to unauthorized data manipulation...

Bare Metal Operator 安全漏洞

Bare Metal Operator is a Metal3 open source application that uses the Kubernetes API to manage bare metal hosts. A security vulnerability exists in Bare Metal Operator versions prior to 0.8.1 and 0.9.1 that stems from improper access control and could lead to secret disclosure...

springboot-openai-chatgpt 安全漏洞

springboot-openai-chatgpt is a SpringCloud microservices architecture based on SpringCloud by 274056675 Individual Developer. A security vulnerability exists in springboot-openai-chatgpt version e84f6f5, which stems from improper access control and could lead to remote attacks...

CVE-2025-2218

A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The...

CVE-2025-23243

NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service...

CVE-2025-24994

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally...

CVE-2025-2278

Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID...

CVE-2025-2280

Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature...

CVE-2025-29997 Improper Access Control Vulnerability in CAP back office application

This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API request URL to gain unauthorized access to other user accounts...

Siemens SCALANCE X-200RNA Switch Devices Improper Access Control (CVE-2015-5352)

The x11openhelper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time...

Siemens SCALANCE X-200RNA Switch Devices Improper Access Control (CVE-2016-10010)

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c. This plugin only works with Tenable.ot. Please visit...

Samsung Galaxy Wearable Access Control Error Vulnerability

Samsung Galaxy Wearable is an official app from the South Korean company Samsung SAMSUNG that is used to manage and connect Samsung's smart wearable devices. Samsung Galaxy Wearable suffers from an Access Control Error vulnerability that stems from improper access control, and no detailed...

InovaLogic CUSTOMER MONITOR 安全漏洞

InovaLogic CUSTOMER MONITOR is a sophisticated IT monitoring and management software from InovaLogic that significantly improves the reliability of IT infrastructure and simplifies remote IT systems. A security vulnerability exists in InovaLogic CUSTOMER MONITOR v3.1.757.1, which stems from...

Devolutions Server 安全漏洞

Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2024.3.13 and prior versions, which stems from improper access control in the Temporary...

Siemens SCALANCE X-200RNA Switch Devices Improper Access Control (CVE-2015-6565)

sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service terminal disruption or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence. This plugin only works with...