CVE-2016-10859: Improper Authorization

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

Microsoft Windows Task Scheduler Local Privilege Escalation

Microsoft Windows Task Scheduler local EoP Report by Social Engineering Neo. Affected Platforms: - Microsoft Windows ≤10 Tested On: - Windows 10 build 1809, 1903 & Windows 7 SP1. Tested on the most recent security patch. July 2019 Class: - Improper Authorization - CWE-285. Remote Code Execution...

CVE-2018-17210: Improper Authorization

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass...

PT-2019-16678

Name of the Vulnerable Software and Affected Versions Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 Description The issue is related to an improper authorization vulnerability in the NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit...

CVE-2019-3734: Undefined Security Weakness

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users...

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Microsoft Windows Task Scheduler suffers from a local privilege escalation vulnerability. The Windows MMC auto-elevates members of the 'administrators' group via the GUI and MMC snap-ins via mmc.exe automatically elevate without prompting UAC potentially leading to unintentional elevation of...

CVE-2018-19578: Improper Authorization

GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page...

CVE-2018-19581: Improper Authorization

GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user to set the weight of an issue they create...

CVE-2018-19569: Improper Authorization

GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope...

CVE-2019-5981

Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with administrative privilege via unspecified vectors...

CVE-2019-5981

CVE-2019-5981 affects Sony VAIO Update via VAIO Update 7.3.0.03150 and earlier. The root cause is improper authorization (CWE-285), which could allow an attacker to execute arbitrary executable files with administrative privileges through unspecified vectors. The impact is that an attacker may ga...

PT-2019-17915

Name of the Vulnerable Software and Affected Versions VAIO Update versions 7.3.0.03150 and earlier Description The issue is related to improper authorization, allowing attackers to execute arbitrary executable files with administrative privileges. The exact vectors used for the attack are not...

CVE-2019-5981: Undefined Security Weakness

Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with administrative privilege via unspecified vectors...

CVE-2017-9325: Improper Authorization

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs...

CVE-2017-8409: Improper Authorization

An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed...

CVE-2018-16074: Improper Authorization

Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page...

CVE-2018-16086: Improper Authorization

Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2018-16077: Improper Authorization

Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2018-16073: Improper Authorization

Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page...

CVE-2019-10154: Improper Authorization

A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations...