CVE-2023-48815

kkFileView v4.3.0 is vulnerable to Incorrect Access Control...

PT-2023-23578 · Unknown · Orocommerce

Name of the Vulnerable Software and Affected Versions: OroCommerce versions prior to 5.0.11 OroCommerce versions prior to 5.1.1 Description: The issue allows back-office users to access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient...

mtgroup.co Improper Access Control vulnerability OBB-3792049

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MikroTik RouterOS 7.1 < 7.12 Access Control Vulnerability

MikroTik RouterOS is prone to an access control vulnerability in the REST API. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-5916 Lissy93 Dashy Configuration save access control

A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack...

CVE-2023-46661 Improper Access Control in Sielco PolyEco1000

Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests...

PT-2023-30149 · Sielco · Sielco Polyeco1000

Name of the Vulnerable Software and Affected Versions: Sielco PolyEco1000 affected versions not specified Description: The issue arises from an improper access control vulnerability. This occurs when the application provides direct access to objects based on user-supplied input, allowing attacker...

PT-2023-7602 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.7.1 macOS versions prior to 13.6.1 macOS versions prior to 14.1 Description: The issue allows a website to access the microphone without the microphone use indicator being shown. This is related to a lack of...

PT-2023-6560

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 6.2.14 Redis versions prior to 7.0.14 Redis versions prior to 7.2.2 Description: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permission...

Anyone can call replenishReserves(...) (token version) to repay borrowed reserves with reserves

Lines of code Vulnerability details Impact The replenishReservestoken, ... can be called by anyone. Proof of Concept The NATSPEC comment in the IBranchPort states the replenishReservestoken, ... can only be called by the port strategy itself as shown below / @notice allow approved address to repa...

PT-2023-27741 · Qsige · Qsige

Name of the Vulnerable Software and Affected Versions: QSige affected versions not specified Description: The QSige login SSO lacks an access control mechanism to verify if a user has sufficient permissions to request a resource. To exploit this, a user must first log into the application...

PT-2023-27746 · Qsige · Qsige

Name of the Vulnerable Software and Affected Versions: QSige affected versions not specified Description: The QSige login SSO lacks an access control mechanism to verify if a user has sufficient permissions to request a resource. To exploit this, a user must first log into the application...

PT-2023-26905 · Unknown · Siberiancms

Name of the Vulnerable Software and Affected Versions: SiberianCMS affected versions not specified Description: The issue concerns improper access control, allowing an authorized user to disable a security feature over the network. Recommendations: At the moment, there is no information about a...

PT-2023-5038 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to insufficient access restrictions in Microsoft Office, which can be exploited to elevate privileges. Recommendations: At the moment, there is no information...

CVE-2021-36036 Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

Magento versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privile...

PT-2023-4954

Name of the Vulnerable Software and Affected Versions: Redis versions 7.0 through 7.0.12 Redis versions 7.2 through 7.2.0 Description: The issue is related to insecure privilege management in Redis, an in-memory database that persists on disk. It does not correctly identify keys accessed by the...

Sentry : Database Open Access Vulnerability

Created Date Aug 14, 2023 2:57:34 PM...

PT-2023-17268 · Candlepin · Candlepin

Name of the Vulnerable Software and Affected Versions: Candlepin affected versions not specified Description: An improper access control flaw was found in Candlepin, allowing an attacker to create data scoped under another customer or tenant. This can result in loss of confidentiality and...

PT-2023-23984 · Sick · Sick Icr890-4

Name of the Vulnerable Software and Affected Versions: SICK ICR890-4 affected versions not specified Description: The issue is related to improper access control, which could allow an unauthenticated remote attacker to affect the availability of the device. This can be done by changing settings o...

PT-2023-21391 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated, due to a...