CVE-2024-10275: Incorrect Authorization

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manag...

CVE-2025-29781

A flaw was found in the Bare Metal Operator BMO Kubernetes API component. BMO enables users to load Secrets from arbitrary namespaces upon deployment of the namespace-scoped Custom Resource BMCEventSubscription. In affected versions, an adversary using a Kubernetes account with only namespace lev...

Linux Distros Unpatched Vulnerability : CVE-2022-31022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pav...

Introducing Wiz Lens: Role-based views for every security team

Empowerment and speed for security teams without losing unified cloud context...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

Sage DPW versions prior to 2024_12_001 are vulnerable to an Incorrect Access Control flaw. The software fails to consistently enforce role-based access controls on the server side, allowing low-privileged users with employee roles to create external courses for other employees. This is achieved b...

CVE-2025-1214

A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /useraccounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-1214

A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /useraccounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-1214 pihome-shc PiHome Role-Based Access Control user_accounts.php authorization

A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /useraccounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-1214

CVE-2025-1214 affects pihome-shc PiHome 2.0, specifically the Role-Based Access Control component. The vulnerability resides in an issue with the /user_accounts.php?uid endpoint, enabling missing authorization and potentially allowing remote exploitation. Several sources confirm that exploitation...

CVE-2025-1214: Missing Authorization

A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /useraccounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit h...

PT-2025-6855 · Unknown · Pihome-Shc Pihome

Name of the Vulnerable Software and Affected Versions: pihome-shc PiHome version 2.0 Description: A critical vulnerability has been found in pihome-shc PiHome, affecting an unknown part of the file /user accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missin...

CVE-2020-4062

In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, including escalating the attacker's...

Incorrect Authorization

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Incorrect Authorization due to improper RBAC enforcement. Remediation Upgrade zenml to version 0.72.0 or higher. References - GitHub Commit - GitHub PR...

GHSA-FCRW-MPHX-7CXF Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qr6x-62gq-4ccp. This link is maintained to preserve external references. Original Description A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367

The CVE-2025-23367 issue affects WildFly’s Server RBAC provider: Suspend and Resume handlers fail to perform authorization checks, allowing a user with Monitor/Auditor roles to suspend or resume the server. The vulnerability is tied to WildFly core/WildFly-server components and is acknowledged in...

CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...