CVE-2025-21187

Microsoft Power Automate Remote Code Execution Vulnerability...

Privilege Escalation

Drupal Core is vulnerable to Privilege Escalation. The vulnerability is due to improper validation of user roles and permissions, which allows unauthorized users to bypass access restrictions and gain elevated privileges...

Amazon Linux 2 : jetty (ALAS-2024-2702)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2702 advisory. There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service DoS attack on the server using DosFilter. By repeatedly sending...

Oqtane Framework Insecure Direct Object Reference vulnerability

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

CVE-2024-56349

In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs...

CVE-2024-56349

CVE-2024-56349 affects JetBrains TeamCity prior to 2024.12. The issue is an improper access control that allows unauthorized users to modify build logs, potentially compromising log integrity. Root cause is insufficient authorization checks on build log modificationacross multiple sources (Red Ha...

Insufficient Access Control

Moodle is vulnerable to Insufficient Access Control. The vulnerability is due to improper validation in the external API for the Quiz module, allowing unauthorized users to override access controls...

PT-2024-33555 · Foundry · Foundry

Name of the Vulnerable Software and Affected Versions: Foundry affected versions not specified Description: A software bug could allow users without permission to view restricted objects directly through the Object Explorer under specific circumstances. This issue did not make data available acro...

Bykea: Ability to increase any customer offered fare (BAC)

A business logic flaw was discovered that allowed a malicious passenger or driver acting as a passenger to increase the fare of another customer's ride without their involvement. By chaining two unauthenticated endpoints, an attacker could cause an inflated fare to appear on the driver's screen...

CVE-2024-11075

The CVE-2024-11075 entry concerns SICK’s Incoming Goods Suite. The description attributes privilege escalation to the use of component vendor Docker images running with root permissions, enabling an unprivileged user with local access to gain administrative control over the system. Affected produ...

CVE-2021-3986

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...

HCL Connections 安全漏洞

HCL Connections is a suite of enterprise collaboration platforms from HCL Corporation, USA. A security vulnerability exists in HCL Connections that stems from unauthorized users updating data in certain circumstances...

Information Disclosure

github.com/graph-gophers/graphql-go is vulnerable to Information Disclosure. The vulnerability is due to improper access controls on the GraphQL introspection query, allowing unauthorized users to access a complete list of available queries and mutations...

CVE-2024-49370

CVE-2024-49370 affects Pimcore portal engine prior to 4.1.7 and 3.1.16. When a PortalUserObject is linked to a PimcoreUser and the “Use Pimcore Backend Password” option is set, the change password function stores the new password without hashing, making it readable by others. This could enable pa...

CVE-2024-50312

CVE-2024-50312 is an Information Disclosure via GraphQL Introspection vulnerability in OpenShift. The connected Red Hat advisory notes that OpenShift Container Platform 4.x releases including 4.16.30 and 4.17.12 were patched to fix this issue, which allowed unauthorized users to enumerate availab...

Eclipse Jetty DoS Vulnerability (GHSA-g8m5-722r-8whq) - Linux

Eclipse Jetty is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

CVE-2024-4739

The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource...

CVE-2024-4739

The issue pertains to MOXA MXsecurity, affecting versions v1.1.0 and prior. Root cause: lack of access restriction to resources, enabling an attacker who has a valid authenticator to impersonate an authorized user and access the resource. Impact: confidentiality could be exposed (as per CVE metri...

CVE-2024-8184 Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote which can be exploited by unauthorized users to cause remote denial-of-service DoS attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory...

CVE-2024-9823 Jetty DOS vulnerability on DosFilter

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service DoS attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory...