CVE-2026-17618

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability where improper authorization allows a remote unauthenticated attacker to view and modify sensitive information. This flaw can also result in a denial of service . While specific affected versions are n...

CVE-2026-8593: Missing Authorization

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...

CVE-2026-45281: Authorization Bypass Through User-Controlled Key

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the...

CVE-2026-32930: Authorization Bypass Through User-Controlled Key

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference IDOR vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings name, max score, weight of evaluations belonging to any other...

Unifiedtransform Access Control Vulnerability

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. Unifiedtransform suffers from an Access Control Error vulnerability that stems from a lack of access control and allows unauthorized users to view and modify other users' information...

CVE-2024-2292: Missing Authorization

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

CVE-2021-41974: Improper Authorization

Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission...

CVE-2021-3352: Undefined Security Weakness

The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access view and modify user data without authorization due to improper handling of tokens...

CVE-2021-27402: Improper Limitation of a Pathname to a Restricted Directory

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

Directory traversal

The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal...

PT-2021-17108

Name of the Vulnerable Software and Affected Versions Mitel MiContact Center Enterprise versions prior to 9.4 Description The issue is related to insufficient access control in the Enterprise License Manager portal, allowing a user to access restricted files and folders. A successful exploit coul...

CVE-2021-26714: Undefined Security Weakness

The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal...

CVE-2020-5580

Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors...

CVE-2018-0436: Improper Access Control

A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between use...

PT-2018-5899

Name of the Vulnerable Software and Affected Versions: SnapCenter versions 2.0 through 3.0.1 Description: The issue allows unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. Recommendations: For versions 2.0 through 3.0.1, upgrade to...