PT-2021-20042

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 4.87 Description The issue allows Wekan to process connections even though they are not authorized by the Certification Authority trust store. This is due to a problem in the packages/wekan-ldap/server/ldap.js file...

CVE-2021-1269: Incorrect Authorization

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. For more information about these vulnerabilities, see the Details section of this...

PT-2021-1837

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM affected versions not specified Description The issue is related to multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM, which could allow an...

PT-2021-1879

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM affected versions not specified Description The issue is related to improper authorization in the web-based management interface of Cisco Data Center Network Manager DCNM, allowing an authenticated, remot...

CVE-2020-7343 Improper Authorization vulnerability in MA

Missing Authorization vulnerability in McAfee Agent MA for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files...

SAP Banking Services Elevation of Privilege Vulnerability

SAP Banking Services is a banking services solution from SAP. A security vulnerability exists in SAP Banking Services, which can be exploited by an attacker to gain elevation of privilege because the program does not perform proper authorization detection...

CVE-2021-21467

SAP Banking Services Generic Market Data does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data GMD, due to improper authorization check...

Authorization

SAP Banking Services Generic Market Data does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data GMD, due to improper authorization check...

CVE-2021-21467: Missing Authorization

SAP Banking Services Generic Market Data does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data GMD, due to improper authorization check...

Doppler VDP: Owner can change themself for another Role Mode but application doesnot have this function.

Hello team, I have found a Privilege escalation bug in your application. Basically your website doesn't allow owner to change role mode for themself, they only can able to change role mode of another user. But i found authorization bug in your application that if we add user id of themself in...

HPE Edgeline Infrastructure Manager Improper Authorization

!/usr/bin/python -- coding: UTF-8 -- billhader.py HPE Edgeline Infrastructure Manager Multiple Remote Vulnerabilities Jeremy Brown jbrown3264/gmail Dec 2020 In \opt\hpe\eim\containers\api\eim\api\urls.py, some private paths are defined which are intended to only be accessible via the local consol...

CVE-2020-24674: Improper Authorization

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

Authorization

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force...

CVE-2020-4794

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force...

CVE-2020-4794: Incorrect Authorization

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force...

PT-2020-18247

Name of the Vulnerable Software and Affected Versions IBM Automation Workstream Services versions 19.0.3, 20.0.1, 20.0.2 IBM Business Automation Workflow versions 18.0, 19.0, 20.0 IBM Business Process Manager version 8.6 Description The issue is due to improper authorization checking, which could...

CVE-2020-4794

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force...

CVE-2020-8920: Improper Authorization

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users'...

CVE-2020-8919: Improper Authorization

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...

CVE-2020-26246: Improper Authorization

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...