PT-2025-2749 · Unknown · Develocity

Name of the Vulnerable Software and Affected Versions: Develocity versions 2023.3.X through 2023.4.X Develocity versions 2023.3.X through 2024.1.7 Develocity versions 2023.4.X through 2024.1.7 Develocity versions prior to 2024.1.8 Description: The issue arises from incorrect access control in...

CVE-2025-0058

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the...

SAP NetWeaver AS security vulnerabilities

SAP NetWeaver AS is an SAP web application server from SAP, Germany. It not only provides web services, but is also the basic platform for SAP software. A security vulnerability exists in SAP NetWeaver AS for ABAP that stems from weak access control and allows an attacker to access restricted...

CVE-2024-32732

Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Confidentiality with no impact on Integrity and Availability of the application...

CVE-2024-45732

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk use...

CVE-2024-45732: Missing Authorization

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk use...

Splunk Enterprise and Splunk Cloud Platform security vulnerabilities

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. A security vulnerability exists in Splunk...

eLabFTW Access Control Vulnerability

eLabFTW is an open source experimental data hosting platform from eLabFTW Open Source. The platform runs on Linux systems and supports storing a wide range of objects. An access control error vulnerability exists in eLabFTW that stems from the presence of incorrect privilege checking that allows ...

OESA-2024-2164 three-eight-nine-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed...

CVE-2024-44121

The CVE-2024-44121 entry describes an information-disclosure vulnerability in SAP S/4HANA Statutory Reports that, under certain conditions, allows a user with basic privileges to access restricted internal data. Affected software is SAP S/4HANA (Statutory Reports) with confidentiality impact note...

SAP S/4 HANA security vulnerabilities

SAP S/4 HANA is an intelligent, integrated ERP software for large enterprises from SAP, Germany. A security vulnerability exists in SAP S/4 HANA that stems from the fact that, under certain circumstances, legal reports in SAP S/4 HANA allow an attacker with basic privileges to access information...

Ivanti EPM security vulnerabilities

Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. A security vulnerability exists in Ivanti EPM that stems from a weak authentication issue contained in the patch management. An authenticated remote attacker could exploit the vulnerability to gain...

PT-2024-30962 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4 HANA affected versions not specified Description: The issue allows an attacker with basic privileges to access restricted information under certain conditions in Statutory Reports. This could expose internal user data that should rema...

DRUPAL-CONTRIB-2024-035

This module enables you to "clone" a content entity, i.e. to create a new content pre-filled with data from another entity of the same type and bundle. The module doesn't properly check the user access to the original entity, allowing users to create a new entity they have permission to create...

CVE-2024-34651

Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files...

CVE-2024-34651

Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files...

CVE-2024-34651

Samsung My Files on Samsung Mobile devices is affected by CVE-2024-34651 due to improper authorization that allows local attackers to access restricted data. The vulnerability affects My Files prior to the SMR Sep-2024 Release 1; remediation is to apply SMR Sep-2024 Release 1 or later updates. Co...

CVE-2024-34651

Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files...

CVE-2024-34651: Incorrect Authorization

Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files...

PT-2024-26071 · M Files · My Files

Name of the Vulnerable Software and Affected Versions: My Files versions prior to SMR Sep-2024 Release 1 Description: The issue is related to improper authorization in My Files, allowing local attackers to access restricted data. This can be exploited by local attackers. Recommendations: For...