The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of access control mechanisms. This allows attackers to bypass security restrictions.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...

Debian: Security Advisory (DLA-184-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-286-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the NTLM network authentication protocol for Windows operating systems allows attackers to circumvent security restrictions and gain increased privileges.

The vulnerability of the NTLM network authentication protocol for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to circumvent security restrictions and enhance their privileges...

Full CSRF Bypass

Description The intended way to reach functionality in $module/ajax.php is through the /xhr endpoint. Looking at the following code: https://github.com/unilogies/bumsys/blob/83bd788c21ce390f62e34ab6755a3e61c106418c/core/route.phpL43-L48 php if $pageSlug === "xhr" or $pageSlug === "info" and...

CVE-2020-5002 IBM Financial Transaction Manager security bypass

IBM Financial Transaction Manager 3.2.0 through 3.2.10 could allow an authenticated user to perform unauthorized actions due to improper validation. IBM X-Force ID: 192954...

CVE-2020-5002 IBM Financial Transaction Manager security bypass

IBM Financial Transaction Manager 3.2.0 through 3.2.10 could allow an authenticated user to perform unauthorized actions due to improper validation. IBM X-Force ID: 192954...

VulnCheck KEV: CVE-2022-21894

Secure Boot Security Feature Bypass Vulnerability...

Osprey Pump Controller 1.0.1 Authentication Bypass Credentials Modification

Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...

KLA48635 OSI vulnerability in Apache Tomcat

Information disclosure vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Fixed in Apache Tomcat 8.5.86 Fixed in Apache Tomcat 10.1.6 Related products Apache-Tomcat CVE list CVE-2023-28708 warning Solution...

CVE-2023-24104

Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets...

KLA48634 OSI vulnerability in Apache Tomcat

Information disclosure vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Fixed in Apache Tomcat 9.0.72 Related products Apache-Tomcat CVE list CVE-2023-28708 warning Solution Update to the latest version...

Admin Able To Perform Operations On Themselves By Interacting With API

Description When setting a password through /admin/users URI, the admin is not allowed to set their own new password through this URI. If they attempt to do so, they receive an error stating Forbidden to operate on yourself. But this is easily bypassable by interacting with the API: if you set a...

K45012151: Layer 2 security bypass issue CVE-2021-27861, CVE-2021-27862, CVE-2021-27853, CVE-2021-27854

Security Advisory Description CVE-2021-27861 Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and optionally VLAN0 headers CVE-2021-27862 Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using...

Improper Access Control

nodejs is vulnerable to Improper Access Control. A remote authenticated attacker is able to bypass security restrictions by sending a specially-crafted request using ICUDATA environment variable, An attacker could exploit this vulnerability to search and potentially load ICU data...

Incorrect parsing of nameless cookies leads to __Host- cookies bypass

Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain. Werkzeug = 2.2.2 will parse the cookie =Host-test=bad as...

SUSE CVE-2005-0231

Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."...

SUSE CVE-2005-3390

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when registerglobals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field...

SUSE CVE-2005-4636

OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings...

SUSE CVE-2006-0884

The WYSIWYG rendering engine "rich mail" editor in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which i...