CVE-2023-34063

VMware Aria Automation (formerly vRealize Automation) is affected by CVE-2023-34063 due to a Missing Access Control flaw. An authenticated attacker could gain unauthorized access to remote organizations and workflows. The vulnerability affects Aria Automation prior to fixed builds; no exploit det...

PT-2024-1101 · Vmware · Vmware Cloud Foundation +1

Name of the Vulnerable Software and Affected Versions: VMware Aria Automation formerly vRealize Automation versions prior to the fixed version VMware Cloud Foundation formerly Aria Automation versions prior to the fixed version Description: The issue is related to a Missing Access Control...

VMSA-2024-0001:VMware Aria Automation (formerly vRealize Automation) updates address a Missing Access Control vulnerability

Advisory ID: VMSA-2024-0001 CVSSv3 Range: 9.9 Issue Date:2024-01-16 Updated On: 2024-01-16 Initial Advisory CVEs: CVE-2023-34063 Synopsis: VMware Aria Automation formerly vRealize Automation updates address a Missing Access Control vulnerability CVE-2023-34063 RSS Feed Download PDF Download Text...

PT-2024-19007 · Pimcore · Pimcore Ecommerce Framework Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Ecommerce Framework Bundle versions prior to 1.0.10 Description: The issue allows an authenticated and unauthorized user to access the back-office orders list and query over the information returned due to a lack of enforced access...

Improper access control

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

CVE-2023-50341 Improper Access Control affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

HCL Technologies DRYiCE MyXalytics Security Breach

HCL Technologies DRYiCE MyXalytics is a unified reporting and dashboard product from HCL Technologies, USA. A security vulnerability exists in HCL Technologies DRYiCE MyXalytics due to a missing access control vulnerability in outdated and accessible web pages...

grafana: missing access control allows test alerts by underprivileged user

A flaw was found in grafana. This issue may allow a malicious user to craft a request to the API that enables them to send alert messages via the "API Alert - Test"...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, and Adobe Acrobat 2020/Adobe Acrobat Reader 2020 are related to lack of access control mechanisms. This allows attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, and Adobe Acrobat Reader 2020 are related to lack of access control. Exploiting these vulnerabilities can allow a malicious actor to execute...

Improper access control

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control...

CVE-2023-3273

CVE-2023-3273 affects SICK ICR890-4. The vulnerability is improper access control that an unauthenticated remote attacker could exploit to affect device availability by changing settings such as the IP address. Reported base score 7.5 (HIGH) with network access and low attack complexity. The core...

CVE-2023-33970

Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a missing access control was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or...

PT-2023-24608

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.30 Description Kanboard is open source project management software that focuses on the Kanban methodology. The software is subject to a missing access control issue that allows a user with low privileges to creat...

PT-2023-24610 · Kanboard · Kanboard

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.30 Description: A missing access control issue was found in Kanboard, allowing a user with the lowest privileges to leak all task and project titles, even if they are not invited or it's a personal project. This...

The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to remove arbitrary users.

The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController function. Exploiting this vulnerability could allow a malicious actor to delete arbitrary users remotely...

Path traversal

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plug...

CVE-2023-28732 Missing access control affecting the AcyMailing plugin for Joomla

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plug...

SUSE CVE-2018-10919

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are...

CVE-2022-43977

An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. The debug port accessible via TCP a qconn service lacks access control...

Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in Rocket.Chat versions prior to 4.7.5, 4.8.0 and later, and prior to 4.8.2, which stems from a lack of ACL checking in its getRoomRoles Meteor method, and can be exploited by an attacker to cause a...