CVE-2024-6323 Improper Isolation or Compartmentalization in GitLab

Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project...

EulerOS 2.0 SP11 : sssd (EulerOS-SA-2024-1847)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...

PT-2024-6675 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.11 through 16.11.4 GitLab EE versions 17.0 through 17.0.2 GitLab EE versions 17.1 through 17.1.0 Description: The issue is related to improper authorization in the global search function, allowing an attacker to leak the...

WAVLINK WN551K1 安全漏洞

The WAVLINK WN551K1 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN551K1 suffers from an information disclosure vulnerability that stems from improper authorization of the livecheck.shtml interface, which can be exploited by an attacker to obtain sensitive router...

WAVLINK WN551K1 安全漏洞

The WAVLINK WN551K1 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN551K1 suffers from an information disclosure vulnerability that stems from improper authorization of the livemfg.shtml interface, which can be exploited by an attacker to obtain sensitive router...

WordPress License Manager for WooCommerce plugin <= 3.0.6 - Improper Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Improper Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Lucio Sá in WordPress Plugin License Manager for WooCommerce versions = 3.0.6...

CVE-2024-35298

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...

CVE-2024-35298

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...

CVE-2024-35298

The CVE-2024-35298 entry is confirmed to affect the ZOZOTOWN Android app (versions prior to 7.39.6). The root cause is improper authorization in the handler for the Custom URL Scheme (CWE-939), which can be exploited to direct the app to access arbitrary websites through another application on th...

CVE-2024-35298

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...

ZOZOTOWN Security Vulnerability

ZOZOTOWN is a fashion shopping application from the Japanese company ZOZO. A security vulnerability exists in ZOZOTOWN versions prior to 7.39.6, which stems from improper authorization in the Custom URL Scheme issue handler and allows an attacker to direct a user to an arbitrary website via anoth...

Improper Authorization

Evmos is vulnerable to Improper Authorization. The vulnerability is due to allowing a user to create a validator using vested tokens to deposit the self-bond...

USN-6836-1 sssd vulnerability

It was discovered that SSSD did not always correctly apply the GPO policy for authenticated users, contrary to expectations. This could result in improper authorization or improper access to resources...

BIT-MAGENTO-2024-34104

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both...

CVE-2024-6000 FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload

The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'displayticketthemespage' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with...

Download Manager < 3.2.90 - Improper Authorization via protectMediaLibrary

Description The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download...

PT-2024-25: Improper Authorization leads to sensitive data access in UniPORT E-slip

The vulnerability was identified in UniPORT E-slip 1.4.0.0 and lower. The discovered vulnerability is caused by insufficient input data validation. It can be exploited by an attacker to gain access to sensitive application data. The vulnerability is unexploitable in versions 1.4.0.0 and higher...

Fortinet FortiClient Web filter bypass (FG-IR-20-127)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-127 advisory. - An improper authorization vulnerabiltiy CWE-285 in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and...

Improper Authorization

@strapi/plugin-content-manager is vulnerable to Improper Authorization. The vulnerability is due to improper access control, allowing users with the Author Role to see items in a collection associated with another collection that they did not create...

Improper Authorization

github.com/hashicorp/vault is vulnerable to Improper Authorization. The vulnerability is due to the JWT auth method improperly validating the audience and role-bound claims, allowing invalid logins to succeed when they should have been rejected...