CVE-2024-22407

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for order...

CVE-2024-20979: Improper Authorization

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

EverShop vulnerable to improper authorization in GraphQL endpoints

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.9, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

GHSA-GGPM-9QFX-MHWG EverShop vulnerable to improper authorization in GraphQL endpoints

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.9, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

CVE-2023-46942

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

CVE-2023-46942: Improper Authentication

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

CVE-2023-46942

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

CVE-2023-46942

CVE-2023-46942 affects the Node package @evershop/evershop, with versions prior to 1.0.0-rc.8. The root cause is a lack of authentication leading to improper authorization on GraphQL endpoints, allowing remote attackers to obtain sensitive information. The CVSS vector from NVD/CNA indicates a hig...

Authorization

A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2022-4962

Summary (CVE-2022-4962) : Several sources describe a vulnerability in Apollo 2.0.0/2.0.1 within the Configuration Center’s /users functionality, causing improper authorization. The issue is exploitable remotely and, per the documents, the exploit has been disclosed publicly. There is no publicly ...

CVE-2022-4962 Apollo Configuration Center users improper authorization

A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2022-4962 Apollo Configuration Center users improper authorization

A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2022-4962 Apollo Configuration Center users improper authorization

A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

PT-2024-11900 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions 2.0.0 through 2.0.1 Description: A vulnerability was found in the Configuration Center component, affecting some unknown functionality of the file /users. This issue leads to improper authorization and can be exploited remotel...

CVE-2022-4962: Improper Authorization

A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

Improper Authorization

pimcore/customer-data-framework is vulnerable to Improper Authorization. The vulnerability is due to insufficient permission enforcement for with the /admin/customermanagementframework/gdpr-data/search-data-objects endpoint. An authenticated user without permission to access this endpoint can que...

Improper Authorization

pimcore/customer-management-framework-bundle is vulnerable to Improper Authorization. The vulnerability is caused due to improper authorization checks within DuplicatesController.php. This allows authenticated and unauthorized user to access the list of potential duplicate users and see their dat...

CVE-2023-6878: Improper Authorization

The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssbajaxupdate' function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level permission...

Improper Authorization

aries-cloudagent is vulnerable to Improper Authorization. The vulnerability is due to improper verification of credentials when a user presents incorrectly constructed proofs. This allows malicious verifiers to save and replay unauthorized presentations...

CVE-2023-40430: Improper Authorization

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent...