Design/Logic Flaw

ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with access to the network where the affected asset is located, to operate and change several parameters without having to be registered as a user...

WordPress Social Share Buttons Access Control Error Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress Social Share Buttons 2.2.3 and prior versions, which stems from an improper access contr...

Privilege escalation

Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high privileges could potentially exploit this vulnerability, leading to the disclosure of the AUI info and performing some unauthorized operation ...

CVE-2021-37123

CVE-2021-37123 affects Huawei Hero-CT060 prior to version 1.0.0.200. The issue is an improper authentication vulnerability caused by insufficient validation of user identity, allowing an attacker to perform operations beyond authorization. Huawei’s advisory HWPSIRT-2021-27560 notes that software ...

Authentication flaw

A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 Modbus SC2-04MOD-07000100 and earlier, Easergy T200 IEC104 SC2-04IEC-07000100 and earlier, and Easergy T200 DNP3 SC2-04DNP-07000102 and earlier that could cause unauthorized operation when authentication ...

CVE-2021-22772

A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 Modbus SC2-04MOD-07000100 and earlier, Easergy T200 IEC104 SC2-04IEC-07000100 and earlier, and Easergy T200 DNP3 SC2-04DNP-07000102 and earlier that could cause unauthorized operation when authentication ...

CVE-2021-22772

A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 Modbus SC2-04MOD-07000100 and earlier, Easergy T200 IEC104 SC2-04IEC-07000100 and earlier, and Easergy T200 DNP3 SC2-04DNP-07000102 and earlier that could cause unauthorized operation when authentication ...

CVE-2021-22772

CVE-2021-22772 affects Schneider Electric Easergy T200 series (Modbus SC2-04MOD-07000100, IEC104 SC2-04IEC-07000100, DNP3 SC2-04DNP-07000102 and earlier). Documented root cause: CWE-306 – Missing Authentication for Critical Function, enabling unauthorized operation when authentication is bypassed...

CVE-2020-19888

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

Design/Logic Flaw

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

CVE-2020-19888

DBHcms v1.2.0 is affected by CVE-2020-19888 due to an access control flaw in dbhcms\page.php at line 175, enabling unauthorized cache operations that can empty a table. Multiple connected sources (Red Hat advisory, CNVD entry, NVD description) corroborate this vulnerability and the implicated fil...

Apple macOS Catalina PackageKit Component Unauthorized Operation Vulnerability

Apple macOS Catalina is a proprietary operating system developed by Apple for Mac computers.PackageKit is an open-source suite of applications for installing and updating Linux software. A security vulnerability exists in the PackageKit component of Apple macOS Catalina versions prior to 10.15.5...

SQLite Unauthorized Operation Vulnerability

SQLite is the United States D. Richard Hipp software developers of a set of C-based open source embedded relational database management system. The system is characterized by independence, isolation, cross-platform and so on. There is a security vulnerability in versions prior to SQLite 3.32.0...

Oracle Virtualization VM VirtualBox Unauthorized Operation Vulnerability

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Oracle E-Business Suite Email Center Unauthorized Operation Vulnerability

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. Email Center is one of the e-mail component. A securi...

Ruby Unauthorized Operation Vulnerability

Ruby is a cross-platform, object-oriented, dynamically typed programming language from the software developer Gyohiro Matsumoto. A security vulnerability exists in Ruby. An attacker can exploit this vulnerability to create arbitrary files...

Atlassian Fisheye and Crucible Unauthorized Operation Vulnerability

Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A security vulnerability exists in the /json/profile/removeStarAjax.do resource in Atlassian Fisheye...

WordPress Unauthorized Operation Vulnerability (CNVD-2020-03944)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions prior to 5.3.1, which stems from a lack of access contro...

CVE-2019-18367

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions...

CVE-2019-13553

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely...