PT-2024-27471 · User Oidc · User Oidc

Name of the Vulnerable Software and Affected Versions: user oidc app versions prior to 3.0.0 user oidc app versions prior to 4.0.0 user oidc app versions prior to 5.0.0 Description: The issue is related to missing access control on the ID4me endpoint, allowing an attacker to register an account a...

GHSA-R978-9M6M-6GM6 Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling

Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher addWatch command to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when th...

Apache Zookeeper 信息泄露漏洞

Apache Zookeeper is a software project of the U.S. Apache Apache Foundation, which is able to provide open source distributed configuration services, synchronization services, and naming registry for large-scale distributed computing. Apache ZooKeeper has an information disclosure vulnerability...

PT-2024-20674 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.11.2 Description: The issue is related to missing access control at the S3 Artifact Storage plugin endpoint. This could potentially allow unauthorized access. Recommendations: For versions prior to...

CVE-2023-34063

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

CVE-2023-34063

VMware Aria Automation (formerly vRealize Automation) is affected by CVE-2023-34063 due to a Missing Access Control flaw. An authenticated attacker could gain unauthorized access to remote organizations and workflows. The vulnerability affects Aria Automation prior to fixed builds; no exploit det...

CVE-2023-34063

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

CVE-2023-34063

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

CVE-2023-34063: Missing Authorization

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

PT-2024-1101

Name of the Vulnerable Software and Affected Versions VMware Aria Automation formerly vRealize Automation versions prior to the fixed version VMware Cloud Foundation formerly Aria Automation versions prior to the fixed version Description The issue is related to a Missing Access Control...

VMSA-2024-0001:VMware Aria Automation (formerly vRealize Automation) updates address a Missing Access Control vulnerability

Advisory ID: VMSA-2024-0001 CVSSv3 Range: 9.9 Issue Date:2024-01-16 Updated On: 2024-01-16 Initial Advisory CVEs: CVE-2023-34063 Synopsis: VMware Aria Automation formerly vRealize Automation updates address a Missing Access Control vulnerability CVE-2023-34063 RSS Feed Download PDF Download Text...

PT-2024-19007 · Pimcore · Pimcore Ecommerce Framework Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Ecommerce Framework Bundle versions prior to 1.0.10 Description: The issue allows an authenticated and unauthorized user to access the back-office orders list and query over the information returned due to a lack of enforced access...

Improper access control

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

CVE-2023-50341 Improper Access Control affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

HCL Technologies DRYiCE MyXalytics Security Breach

HCL Technologies DRYiCE MyXalytics is a unified reporting and dashboard product from HCL Technologies, USA. A security vulnerability exists in HCL Technologies DRYiCE MyXalytics due to a missing access control vulnerability in outdated and accessible web pages...

PT-2023-31562

Name of the Vulnerable Software and Affected Versions femanager Extension extension for TYPO3 affected versions not specified Description The issue concerns a security bypass in the femanager Extension for TYPO3. It is caused by a missing access check for the edit user component, allowing an...

grafana: missing access control allows test alerts by underprivileged user

A flaw was found in grafana. This issue may allow a malicious user to craft a request to the API that enables them to send alert messages via the "API Alert - Test"...

CVE-2023-6189

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods...

CVE-2023-6189

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods...

PT-2023-32558 · M Files · M-Files Server

Name of the Vulnerable Software and Affected Versions: M-Files server versions prior to 23.11.13156.0 Description: The issue is related to missing access permissions checks in the M-Files server, allowing attackers to perform data write and export jobs using the M-Files API methods...