CVE-2021-22863 Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker woul...

Joomla 安全漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. An incorrect ACL checking vulnerability exists in Joomla! 3.0.0 - 3.9.24. An...

Advantech iView Critical Functions Lack Authentication Vulnerability

Advantech iView is a device management application for the energy, water and wastewater industries. A vulnerability exists in Advantech iView prior to version 5.7.03.6112 due to a lack of authentication for critical functions. An attacker could use this vulnerability to make unauthorized changes ...

Advantech Iview 访问控制错误漏洞

Advantech iView is a device management application for the energy, water and wastewater industries. A vulnerability exists in Advantech iView prior to version 5.7.03.6112 due to a lack of authentication for critical functions. An attacker could use this vulnerability to make unauthorized changes ...

Adobe Magento 跨站请求伪造漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

newbee-mall Access Control Error Vulnerability

newbee-mall is an e-commerce system. An access control error vulnerability exists in all versions of newbee-mall, where an attacker cannot remotely gain privileges via NewBeeMallIndexConfigServiceImpl. java, but can make unauthorized changes to any user information via userID...

CVE-2020-23449

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID...

Design/Logic Flaw

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID...

CVE-2020-23449

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID...

CVE-2020-27256

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers with physical access to change insulin therapy settings...

CVE-2020-29160

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

CVE-2020-24403

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the...

Spoofing

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the...

CVE-2020-22273

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

CVE-2020-22273

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

Unspecified Vulnerability in Oracle Java SE and Oracle Java SE Embedded (CNVD-2020-61049)

Oracle Java SE and Oracle Java SE Embedded are both products of Oracle Corporation.Oracle Java SE is a Java platform for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments.Oracle Java SE Embedded is a Java platform that targets Java...

PT-2020-4579 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to incorrect user permissions within the Inventory component, allowing authenticated users with Inventory and Source permissions to make unauthorized changes to...

CVE-2020-7383 SQL Injection in Rapid7 Nexpose

A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & make changes they should not have been able to access...

PT-2020-15526 · Jenkins · Jenkins Shared Objects Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Shared Objects Plugin versions 0.44 and earlier Description: A cross-site request forgery CSRF issue allows attackers to configure shared objects. This can be exploited by attackers to perform unauthorized actions. Recommendations: Fo...

CVE-2020-12506

Improper Authentication vulnerability in WAGO 750-8XX series with FW version = FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO...