zz 安全漏洞

zz is an e-commerce platform for zj1983 individual developers. A security vulnerability exists in zz 2024-8 and prior versions that stems from improper authorization...

CVE-2025-1815

Affected software: pbrong hrms up to 1.0.1. The vulnerability occurs in HrmsDB (resource.go) due to manipulation of the user_cookie argument, causing improper authorization. This enables a remote attack, and the exploit has been disclosed publicly. No patch/version remediation details are provide...

CVE-2025-1815 pbrong hrms resource.go HrmsDB improper authorization

A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument usercookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-1815 pbrong hrms resource.go HrmsDB improper authorization

A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument usercookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-1806

A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to improper authorization. The attack may be launched remotely...

hrms 安全漏洞

hrms is a human resource management system from BoringError Individual Developers. A security vulnerability exists in hrms 1.0.1 and prior versions that stems from improper authorization and could lead to remote code execution...

Eastnets PaymentSafe 安全漏洞

Eastnets PaymentSafe is a fast gpi payment screening solution from Eastnets UAE that detects and prevents fraud in real time. A security vulnerability exists in Eastnets PaymentSafe version 2.5.26.0 that stems from improper authorization and could lead to remote code execution...

CVE-2025-1806

CVE-2025-1806 affects Eastnets PaymentSafe 2.5.26.0, specifically the /Default.aspx file in the URL Handler. The issue arises from improper authorization in an unknown function, with remote attack potential. Public exploit information is available, and multiple sources concur on the exposure. A f...

CVE-2025-1806 Eastnets PaymentSafe URL Default.aspx improper authorization

A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to improper authorization. The attack may be launched remotely...

CVE-2025-1806 Eastnets PaymentSafe URL Default.aspx improper authorization

A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to improper authorization. The attack may be launched remotely...

PT-2025-9187 · Eastnets · Eastnets Paymentsafe

Name of the Vulnerable Software and Affected Versions: Eastnets PaymentSafe version 2.5.26.0 Description: A problem has been found in Eastnets PaymentSafe, affecting some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to improper authorization...

Security Bulletin:Vulnerability in Apache Druid affects watsonx.data

Summary Apache Druid could allow a remote attacker to bypass security restrictions. These could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-45384 DESCRIPTION: Apache Druid could allow a remote attacker to bypass security restrictions, caused by a flaw in the druid-pac4j extension. B...

WSO2 API Manager和WSO2 Identity Server 安全漏洞

WSO2 API Manager and WSO2 Identity Server IS are both products of WSO2, Inc.WSO2 API Manager is an API lifecycle management solution.WSO2 Identity Server is an identity server. A security vulnerability exists in WSO2 API Manager and WSO2 Identity Server that stems from improper authorization...

GHSA-8XV7-G2Q3-FQGC Mautic allows Improper Authorization in Reporting API

Summary This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any...

CVE-2024-47053

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated use...

CVE-2024-47053 Improper Authorization in Reporting API

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated use...

Gitlab -- Vulnerabilities

Gitlab reports: XSS in k8s proxy endpoint XSS Maven Dependency Proxy HTML injection leads to XSS on self hosted instances Improper Authorisation Check Allows Guest User to Read Security Policy Planner role can read code review analytics in private projects...

The vulnerability of the microprogrammed software for Intel Ethernet Connection I219 adapters, related to improper authentication, allows a hacker to trigger a service failure.

The vulnerability of the Microprogrammed Software for Intel Ethernet Connection I219 adapter is related to improper authorization. Exploiting this vulnerability can allow an attacker to cause a service failure...

Improper Authorization

Overview glpi/glpi is a free Asset and IT Management Software package with ITIL Service Desk, licenses tracking and software auditing. Affected versions of this package are vulnerable to Improper Authorization via the update.php file which allows an attacker to disable all active plugins by...

CVE-2025-1007 Improper Authorization in /user/namespace/{namespace}/details

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/namespace/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in...