SyroTech SY-GPON-1110-WDONT Access Control Error Vulnerability

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an Access Control Error vulnerability that arises from the presence of root terminal access on the serial interface without proper access control. An attacker could exploit this...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the POST /secretaries endpoint, allowing low privileged users to create other low privileged users secretaries, resulting in unauthorized data manipulation...

CVE-2024-2359 Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui

A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises from the application's handling of the /executecode endpoint, which is intended to be blocked from external access by default. However,...

CVE-2024-5449 WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization

The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdmsocialsharesaveoptions function in all versions up to, and...

Information Disclosure

neos/neos is vulnerable to Information Disclosure. The vulnerability is due to improper access controls allowing the viewing of internal workspaces without authentication. This allows attackers to read sensitive content from internal workspaces without permission...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

PT-2024-41440 · Ooo 'Пэрко' · Perco-Web

Уязвимость системы контроля доступа PERCo-Web связана с неверным ограничением имени пути к каталогу. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации...

CVE-2024-0671 Mali GPU Kernel Driver allows improper GPU memory processing operations

Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alread...

Firewall Bypass

github.com/edgelesssys/constellation is vulnerable to Firewall Bypass. The vulnerability is due to the world configuration which does not prevent unauthorized access to entities inside the cloud VPC to directly reach pods using their internal IP addresses...

CVE-2021-47155

The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which in some situations allows attackers to bypass access control that is based on IP addresses...

PT-2024-15238 · WordPress · Backup/Restore Wordpress – Backup Plugin

Name of the Vulnerable Software and Affected Versions: Backup and Restore WordPress plugin versions 1.45 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as site configuration, by not protecting some log files. This poses a severe threat to...

PT-2024-2030 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: The issue is related to inadequate access control in Mattermost, allowing remote attackers to gain unauthorized access to files in archived channels. Specifically, members can access files...

PT-2024-21923 · Atheme · Atheme

Name of the Vulnerable Software and Affected Versions: Atheme version 7.2.12 Description: The issue is a memory leak vulnerability located in the /atheme/src/crypto-benchmark/main.c file. Recommendations: For Atheme version 7.2.12, consider restricting access to the vulnerable file...

Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Struts. The issue results from improper access control. An attacker can...

PT-2024-3288 · Wikimedia +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.39.6 and earlier, 1.40.x versions prior to 1.40.2, 1.41.x versions prior to 1.41.1 Description: An issue was discovered in WikibaseLexeme, related to inadequate access control. This issue allows an attacker to make an edi...

sontokusya.co.jp Improper Access Control vulnerability OBB-3844230

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-52100

The Celia Keyboard module has a vulnerability in access control. Successful exploitation of this vulnerability may affect availability...

CVE-2023-40362

An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known...

CVE-2022-48577

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data...

WordPress WooCommerce Shipping Per Product Plugin <= 2.5.4 is vulnerable to Broken Access Control

Software WooCommerce Shipping Per Product Type Plugin Vulnerable versions = 2.5.4 Fixed in 2.5.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51499 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 08c4c7d68a1f Credits Rafie...