81 matches found
BIT-JOOMLA-2026-90917 Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260907 - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories...
CVE-2026-90917
Joomla! Core - 20260907 - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories...
PT-2026-96104
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description An issue exists where the software identifies existing reports using a UUID without verifying if the report belongs to the same event. An attacker with editor access to at least one event who knows or...
CVE-2026-21848: Improper Access Control
HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...
PT-2026-68977
Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...
CVE-2025-70962: Improper Access Control
Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...
CVE-2025-70962
The ZOSI C519M smart IP camera (firmware V4.2.8.832C01450BA ) is vulnerable to Incorrect Access Control due to hardcoded credentials in the RTSP authentication mechanism . The credentials admin:admin are stored in plain text within the /app/config.xml file and cannot be changed by the owner, even...
CVE-2025-70962
Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...
EUVD-2026-50483
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...
ZTE ZXUniPOS NDS-LTE access control vulnerability
ZTE ZXUniPOS NDS-LTE is a modular baseband unit designed for wireless communication networks. It primarily provides multi-mode and multi-frequency signal processing as well as data aggregation functions. ZTE ZXUniPOS NDS-LTE has an access control vulnerability. This vulnerability arises from the...
PT-2026-40853
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.1 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2 Description An issue exists where an authenticated user with Guest permissions can view issues in projects they a...
EUVD-2026-11061
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain...
CVE-2025-15395
IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability...
PT-2025-51322
Name of the Vulnerable Software and Affected Versions Misskey versions 13.0.0-beta.16 through 2025.12.0 Description Misskey is a federated social media platform. Users without the necessary permissions to view favorites or clips could export posts and access their contents. Recommendations Update...
CVE-2025-13472
CVE-2025-13472 concerns the BlazeMeter Jenkins Plugin. The Red Hat and NVD entries, plus multiple security advisories, confirm that versions prior to 4.27 expose a list of sensitive resources (credential IDs, BlazeMeter workspaces, and project IDs) to users who should not have access. The underly...
CVE-2025-43024
A GUI dialog of an application allows to view what files are in the file system without proper authorization...
PT-2025-44062
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A GUI dialog within an application permits unauthorized viewing of files present in the file system. This occurs due to a lack of appropriate authorization checks when displaying file system contents...
HubSpot 安全漏洞
HubSpot is a customer relationship management platform in the United States. A security vulnerability exists in HubSpot version v1.29441, which stems from improper access control of REST API endpoints and could lead to unauthorized viewing of user data...