Privilege Escalation

github.com/rancher/rancher is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation which allows an unauthorized user to log in with administrative privileges...

Information Exposure

github.com/rancher/rancher is vulnerable to information exposure. The vulnerability exists due to lack of input validation which allows an unauthorized user to access sensitive information in the system...

Privilege Escalation

github.com/rancher/rancher is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation which allows an unauthorized user to make changes to the system...

CVE-2022-22276

A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user...

CVE-2022-22276

A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user...

MaxBoard 跨站脚本漏洞

Max Yi MaxBoard is a CMS Content Management System or Web framework from Max Yi Korea. It helps to make website creation and site management easier, and can be easily and conveniently used to build the back-end of an application. A cross-site scripting vulnerability exists in MaxBoard versions...

Red Hat Single Sign-On 安全漏洞

Red Hat Single Sign-On is an authentication and access control system from the American company Red Hat Red Hat. The tool is responsible for authentication and access control functions for the system, supports most authentication protocols Oauth, OpenId Connect, etc., and can be easily integrated...

GitLab 12.2 < 14.7.7 / 14.8 < 14.8.5 / 14.9 < 14.9.2 (CVE-2022-1189)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that...

CVE-2021-46416

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...

CVE-2021-46416

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...

CVE-2021-46416

CVE-2021-46416 concerns the SUNNY TRIPOWER 5.0 firmware (version 3.10.16.R). The vulnerability arises from insecure cookie handling that enables an insecure direct object reference, allowing an unauthorized user group to access restricted functionality. The issue is described in the CVE entry as ...

CVE-2022-1105

An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled...

CVE-2022-1105

Removed by vendor...

CVE-2021-32953

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login...

TikTok: IDOR on TikTok Ads Endpoint

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Ads endpoint, which could have resulted in an unauthorized user adding products into another user's catalogue. We thank @sinayeganeh for reporting this to our team...

CVE-2022-0735

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure...

CVE-2022-0735

Removed by vendor...

SAP Financial Consolidation Access Control Error Vulnerability

SAP Financial Consolidation is a financial statement solution from SAP Germany. The SAP Financial Consolidation access control error vulnerability, which stems from the program's failure to perform the authorization checks required to update home page messages, could be exploited to cause an...

CVE-2022-26104

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message...

Privilege Escalation

github.com/clastix/capsule-proxy is vulnerable to privilege escalation. The vulnerability exists due to the malicious Connection header in the Kubernetes API Server allowing an unauthorized user to gain cluster-admin privileges...