Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Open Social prior to version 12.0.5, which stems from the inclusion of an improper authorization vulnerability...

Authentication Bypass

Elasticsearch is vulnerable to Authentication Bypass. The vulnerability is due to improper implementation of authorization controls, allowing a malicious actor to circumvent Document Level Security and access restricted documents...

CVE-2024-56320

GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authenticated GoCD user with an existing GoCD...

CVE-2024-56320

GoCD before 24.5.0 is vulnerable to admin privilege escalation via improper authorization of the admin “Configuration XML” UI and related API. An authenticated GoCD user with an existing account can access information intended only for admins or elevate privileges to admin, with exploitation requ...

PT-2025-1147 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 24.5.0 Description: The issue is related to improper authorization of access to the admin "Configuration XML" UI feature and its associated API in the GoCD system, allowing a malicious insider or existing authenticated...

ZenML < 0.56.2 Vulnerability - CVE-2024-2035

The version of ZenML installed on the remote host is prior to 0.56.2. It is, therefore, affected by An improper authorization vulnerability exists in the API /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing th...

CVE-2024-13109

A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects some unknown processing of the file /doc.html. The manipulation leads to improper authorization. The attack may be initiated remotely. The...

CVE-2024-13109 Beijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization

A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects some unknown processing of the file /doc.html. The manipulation leads to improper authorization. The attack may be initiated remotely. The...

CVE-2024-13109 Beijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization

A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects some unknown processing of the file /doc.html. The manipulation leads to improper authorization. The attack may be initiated remotely. The...

CVE-2024-13109

CVE-2024-13109 affects Beijing Yunfan Internet Technology Yunfan Learning Examination System v1.9.2. The issue arises from processing of the file /doc.html, enabling improper authorization and a remote-possible attack. Public exploit information is present. Affects a known version; remediation gu...

PT-2025-2007 · Beijing Yunfan Internet Technology · Yunfan Learning Examination System

Name of the Vulnerable Software and Affected Versions: Beijing Yunfan Internet Technology Yunfan Learning Examination System version 1.9.2 Description: A critical issue has been found in the system, affecting some unknown processing of the file /doc.html. The manipulation leads to improper...

Yunfan Learning Examination System 安全漏洞

Yunfan Learning Examination System is an examination application from China Yunfan Yunfan Company. A security vulnerability exists in Yunfan Learning Examination System version 1.9.2, which stems from some unknown processing of the file /doc.html that can lead to improper authorization...

Improper Authorization

Overview PyNinja is a Lightweight OS-agnostic service monitoring API Affected versions of this package are vulnerable to Improper Authorization due to the ability to access the '/monitor' page, which exposes sensitive information. Remediation Upgrade PyNinja to version 1.1.0 or higher. References...

Improper Authorization

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Improper Authorization due to improper validation of user permissions in the items.queries.php component. An attacker can gain unauthorized access to folders by exploiting the lack of prop...

Improper Authorization

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Improper Authorization due to improper authorization checks in the mailme operation of the mailHandler function. An attacker can escalate privileges and perform actions reserved for...

CVE-2020-9081

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. Vulnerability ID: HWPSIRT-2019-12144 This vulnerability has...

CVE-2020-9081

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. Vulnerability ID: HWPSIRT-2019-12144 This vulnerability has...

CVE-2020-9081

There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this vulnerability. Successful exploit could allow the attacker to bypass app lock. Vulnerability ID: HWPSIRT-2019-12144 This vulnerability has...

PT-2024-10859 · Huawei · Huawei Smartphone

Name of the Vulnerable Software and Affected Versions: Huawei smartphones affected versions not specified Description: The issue is related to an improper authorization vulnerability. An attacker could perform a series of operations in a specific mode to exploit this vulnerability, potentially...

CVE-2024-12901

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be...