PT-2023-14905 · Sguda · Sguda U-Lock

Name of the Vulnerable Software and Affected Versions: SGUDA U-Lock central lock control service affected versions not specified Description: The issue is related to incorrect authorization in the user management function of the SGUDA U-Lock central lock control service. A remote attacker with...

CVE-2023-32709: Improper Authorization

In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against th...

CVE-2023-34091: Improper Authorization

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction field is set to Enforce. This situation...

CVE-2023-32717: Improper Authorization

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID SID of an existing search job...

CVE-2023-34219: Improper Authorization

In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API...

CVE-2023-33189: Improper Authorization

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2...

CVE-2023-33183: Improper Authorization

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in improper authorization, which allows attackers to disclose protected information.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to improper authentication. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Improper Authorization in "Customer automation rules" function

Description The product performs authorization checks incorrectly when an unauthorized actor tries to access a resource or perform an actions. Proof of Concept The user does not have permission to delete the rule. Location - GET /admin/customermanagementframework/rules/list - POST...

CVE-2023-2950

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950

CVE-2023-2950 affects OpenEMR prior to 7.0.1 and is tied to improper authorization that enables an HTML-injection vulnerability through the patient portal API. Specifically, the PUT endpoint /openemr/portal/patient/api/onsitedocument/{id} accepts a fullDocument payload; a malicious user can modif...

PT-2023-5352 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.1 Description: The issue is related to improper authorization in the OpenEMR software, which can be exploited by a remote attacker to perform HTML injection. Recommendations: For versions prior to 7.0.1, update t...

CVE-2023-2950 Improper Authorization in openemr/openemr

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950: Improper Authorization

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

CVE-2023-2950

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1...

Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Microsoft Windows Active Directory Certificate Services Improper Authorization Privilege Escalation Vulnerability

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of Microsoft Windows Active Directory Certificate Services. Authentication is required to exploit this vulnerability. The specific flaw exists within the issuance of certificates. By including...

PT-2023-2907 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x Description: The issue is related to improper authorization in the Hitachi Vantara Pentaho Business Analytics Server. Exploitation of this...

CVE-2023-28623: Improper Authorization

Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: ZulipLDAPAuthBackend and an external authentication backend any aside of ZulipLDAPAuthBackend and EmailAuthBackend are the only ones enabled in AUTHENTICATIONBACKENDS in /etc/zulip/settings.py...