Improper Access Control

contao/contao is vulnerable to Improper Access Control. The vulnerability is due to news feeds not filtering protected news archives, which allows an attacker to access and view restricted news items through the public RSS feed...

PT-2025-39365

Name of the Vulnerable Software and Affected Versions Saysis Web Portal versions 3.1.9 through 3.2.0 Description A Path Traversal issue exists in Saysis Web Portal. The issue allows unauthorized access due to improper limitation of a pathname to a restricted directory. Recommendations Update to...

The vulnerability of the testGrantSlicePermission() function in the SliceManagerTest.java module of Android operating systems allows a hacker to trigger a service failure.

The vulnerability of the testGrantSlicePermission function in the SliceManagerTest.java module of Android operating systems is related to incorrect path name restrictions for restricted directories. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2025-39358

Name of the Vulnerable Software and Affected Versions Yordam Katalog versions prior to 21.7 Description The software contains a path traversal flaw. An attacker can potentially exploit this by crafting a malicious path, such as 'dir/../../filename', to access unauthorized files and directories...

The vulnerability of the ColdFusion software platform lies in the incorrect limitation of the path name for the restricted access catalog, allowing attackers to write arbitrary files.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the restricted access catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure Firewall Threat Defense 安全漏洞

Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense are both products of Cisco, Inc.Cisco Secure Firewall Adaptive Cisco Secure Firewall Adaptive Security Appliance is an enterprise-class firewall software.Cisco Secure Firewall Threat Defense is an integrate...

VulnCheck KEV: CVE-2025-20362

Cisco Secure Firewall Adaptive Security ASA Appliance and Secure Firewall Threat Defense FTD Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333...

CVE-2025-57907

Missing Authorization vulnerability in Heureka Group Heureka heureka allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Heureka: from n/a through = 1.1.0...

CVE-2025-57944

Missing Authorization vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through = 1.3...

The vulnerability in the embedded web server of Lexmark’s microprogramming software allows a perpetrator to execute arbitrary code.

The vulnerability of the embedded web-server microprogramming software of Lexmark printers is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-58029

Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through = 1.0.1...

WordPress plugin WP Compress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

The vulnerability of the integration IoT/SCADA platform Delta Industrial Automation DIALink, which stems from incorrect naming restrictions on paths leading to restricted-access catalogs, allows a perpetrator to execute arbitrary codes.

The vulnerability of the integration IoT/SCADA platform Delta Industrial Automation DIALink is related to an incorrect restriction on the path name to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

PT-2025-38794

Name of the Vulnerable Software and Affected Versions Skimlinks versions through 1.3 Description A missing authorization issue exists in the Skimlinks Affiliate Marketing Tool. The issue allows access to functionality that is not properly constrained by Access Control Lists ACLs. Recommendations...

CVE-2025-59040

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition...

GHSA-F72G-52V7-MG3P Mattermost boards plugin fails to restrict download access to files

Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...

CVE-2025-10468 Path Traversal in Beyaz Computer's CityPLus

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affects CityPlus: before 24.29375...

CVE-2025-10468

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affects CityPlus: before 24.29375...

The vulnerability of the NVIDIA NVDebug debugging and diagnostic software tool arises from incorrect restrictions on the path to the restricted directory. This allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of the NVIDIA NVDebug debugging and diagnostic software tool is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected...

The vulnerability in the `apply.cgi` script of the Linksys E1500 and E2500 router microprogramming system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the apply.cgi script of the Linksys E1500 and E2500 router microprogramming system is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected informati...