CVE-2022-24002

Samsung Link Sharing is affected by an improper authorization vulnerability (PreconditionActivity) that could allow an attacker to open a protected activity in versions prior to 12.4.00.3. The issue is documented across multiple sources (CVE-2022-24002, Red Hat, NVD, PRION, etc.). Affected produc...

CVE-2022-24002

Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity...

PT-2022-16404 · Unknown · Link Sharing

Name of the Vulnerable Software and Affected Versions: Link Sharing versions prior to 12.4.00.3 Description: The issue allows attackers to open protected activity via PreconditionActivity due to an improper authorization vulnerability in Link Sharing. Recommendations: For versions prior to...

PT-2022-1677 · Microsoft · Onedrive App For Android

Name of the Vulnerable Software and Affected Versions: Microsoft OneDrive for Android affected versions not specified Description: The issue is related to a security feature bypass vulnerability in the file hosting service of OneDrive for Android, associated with improper authorization...

Improper Authorization in phpipam/phpipam

Description In phpIPAM 1.4.5, a normal user with the role of Usercould view/read the log files via show-logs.php, errorlogs.php and accesslogs.php endpoints. It is supposedly accessible by the Administrator only. Proof of Concept Tested version: phpIPAM 1.4.5 Affected endpoints: 1 GET/POST...

Improper Authorization in bytebase/bytebase

Description Hello bytebase team, there is an improper privilege management in bytebase source code. This allows a user to view another user inbox. Proof of Concept 1. Install bytebase, create new user user1and user2 2. Login as user1, go to this link /api/inbox?user=user-id and change user-id to ...

CVE-2022-22565

Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. An authenticated and privileged user could potentially exploit this vulnerability, leading to disclosure or modification of sensitive data...

Improper Authorization in janeczku/calibre-web

Description With default settings, low-level users will not have permission to edit the sort order of books in private shelf of another user. However, due to incorrect checking, the application does not work as intended. Proof of Concept - Step 1: Login with admin account and go to...

Improper Authorization in liukuo362573/yishaadmin

Description When downloading files using the /admin/File/DownloadFile?filePath= URI, you're able to download any file you want, as long as you know the path of the file, even as an unauthenticated user. This means that an unauthenticated user could download the /etc/passwd/ file or any file that...

Improper Authorization in liukuo362573/yishaadmin

Description Hi there, there is another Improper authorization in /admin/OrganizationManage/Department/GetFormJson Proof of Concept 1. Open link http://106.14.124.170/admin/OrganizationManage/Department/GetFormJson?id=16508640061124402 without logging in demo page. 2. See that department data is...

Improper Authorization in liukuo362573/yishaadmin

Description Hi there yisshadmin team, I would like to report an improper authorization in yishaadmin source code. The link /admin/ToolManage/Server/ServerIndex requires no authorization and available for anyone to view server information like IP, RAM, CPU... Proof of Concept 1. Access the link...

CVE-2022-22288

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...

CVE-2022-22288

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...

CVE-2022-22288

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...

CVE-2022-22272

Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...

CVE-2022-22272

Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...

CVE-2022-22272

Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...

Fortinet FortiOS and FortiProxy Improper Authorization

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password...

Samsung SMR 安全漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in Samsung SMR that originates from improper authorization in TelephonyManager and allows an attacker to gain access to IMSI without the...

CVE-2022-22288

CVE-2022-22288 affects Samsung Galaxy Store; vulnerability is an improper authorization flaw in Galaxy Store prior to version 4.5.36.5 that enables remote installation from the allowlist. Root cause per sources is improper authorization allowing an attacker to trigger installations without proper...