Insecure Access Control

cockpit has insecure access control. The vulnerability exists due to a flaw was found in Cockpit allowing client certificates to authenticate successfully, regardless of the Certificate Revocation List CRL configuration or the certificate status...

Insecure Access Control

shenyu has insecure access control. The vulnerability exists due to a lack of validation of the user access via the /plugin api allowing an attacker to access the system without authentication...

Design/Logic Flaw

In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods...

Insecure Access Control

389-ds-base is vulnerable to insecure access control. The vulnerability exists due to a lack of sanitization which allows an attacker to gain authorization with an asterisk in the password...

CVE-2021-41503

DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This...

Information disclosure

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user guest, standard, or admin to view and modify information...

CVE-2021-37709

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding securit...

CVE-2021-25954

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint...

Insecure Access Controls

github.com/argoproj/argo-cd uses insecure access controls. The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-brute-force measures. An attacker is able to repeatedly perform authentication attempts to discover user credentials...

Insecure Access Control

directmailteam/direct-mail uses insecure access controls. The extension fails to check if an authenticated backend user has access to newsletter subscriber tables e.g. ttaddress, feusers when using the CSV export function of the extension...

Insecure Access Control

chromium is uses an insecure access control. An insufficient policy enforcement was found in the Android intents component, allowing an attacker to bypass security restrictions...

Insecure Access Control

github.com/containerd/containerd uses insecure access controls. Pulling of malicious image can cause Unix file permission changes for existing files in the host's file system. This can result in restriction of access to files which should otherwise by accessible...

Insecure Access Control

github.com/pterodactyl/wings allows insecure access to endpoints. An attacker is able to access resources on local networks that would otherwise be inaccessible due to lack of hostname verification...

Emmanuel MyDomoAtHome 安全漏洞

GitLab Emmanuel MyDomoAtHome is a GitLab open source application. A REST interface to ImperoHome with Domoticz ISS. Emmanuel MyDomoAtHome has a security vulnerability that stems from incorrect access control implementation. An unauthenticated, remote attacker could use the vulnerability could...

Insecure Access Controls

@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...

Insecure Access Control

mediawiki uses an insecure access control. A user is able to protect a page to a higher level than they currently have permissions for...

Content Spoofing

chromium is vulnerable to content spoofing. An insecure access control allows an attacker who has compromised the renderer process to spoof contents of the Omnibox via a malicious HTML page...

Insecure Access Control

shinobi uses insecure access controls. An attacker is able to access the User/Admin/Super API functions through the use of JS Proto Method names held in an internal JS Object and trick the System into accepting supplied API Key that exists in the underlying JS object...

CVE-2021-27509

In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code...

Insecure Access Controls

Xen is vulnerable to denial of service. Unprivileged guest users are able to obtain and modify permissions, list and delete root nodes. This is due to permissions that are not properly enforced...