PT-2022-27242 · Unknown · Smarttrimprocessevent

Name of the Vulnerable Software and Affected Versions: SmartTrimProcessEvent module affected versions not specified Description: The issue concerns the SmartTrimProcessEvent module, which has a vulnerability that allows obtaining read and write permissions on arbitrary system files. This could...

PT-2022-15192 · Johnson Controls · Metasys Adx Server

Name of the Vulnerable Software and Affected Versions: Metasys ADX Server version 12.0 Description: The issue allows an Active Directory user to execute validated actions without providing a valid password when using MVE SMP UI. Recommendations: For Metasys ADX Server version 12.0, consider...

CVE-2022-38134

Authenticated subscriber+ Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin = 5.3.5 at WordPress...

PT-2022-16361 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue arises from the Revocation Notifier in Keylime using a fixed /tmp path for a UNIX domain socket. This can be exploited by unprivileged users to prohibit Keylime operations. Recommendation...

PT-2022-25488 · Nokia · Nokia 1350 Oms

Name of the Vulnerable Software and Affected Versions: NOKIA 1350OMS version R14.2 Description: A reflected XSS issue was discovered, affecting various "/cgi-bin/R14.2" API endpoints. Recommendations: For NOKIA 1350OMS version R14.2, consider restricting access to the affected "/cgi-bin/R14.2" AP...

CVE-2022-39205 Access Control Bypass in Onedev

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

PT-2022-23670 · Google · Android

Name of the Vulnerable Software and Affected Versions: Broadcaster in Group Sharing versions prior to 13.0.6.15 in Android S12 Broadcaster in Group Sharing versions prior to 13.0.6.14 in Android R11 and below Description: The issue is related to improper access control, allowing attackers to...

PT-2022-4271 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a lack of protection for internal data in the Windows operating system, which can allow an attacker to gain unauthorized access to protected information. This can...

Denial Of Service (DoS)

evmos/ethermint is vulnerable to Denial Of Service DoS. The vulnerability exists in the deleteaccount function in statedb.go due to improper access control which allows an attacker to crash the system by sending a specially-crafted request using the self-destruct function...

PT-2022-17778 · Tooljet · Tooljet

Name of the Vulnerable Software and Affected Versions: tooljet/tooljet versions prior to v1.19.0 Description: The issue is related to improper access control. Recommendations: For versions prior to v1.19.0, update to version v1.19.0 or later to resolve the issue...

Moodle does not force password changes for autosubscribed users

admin/uploaduserform.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user...

Information Disclosure

Slurm is vulnerable to information disclosure. The vulnerability exists due to an incorrect access control that leads to information disclosure...

CVE-2022-29128

Technical details for CVE-2022-29128 (affected product/version, root cause, impact, or fix) are not provided in the connected documents. The sources reference general LDAP RCE concerns and Windows updates, but no concrete vulnerability specifics. Monitor for updates.

U.S. Dept Of Defense: ██████ SSN/EDPI

The vulnerability allowed authenticated users to request other soldiers' personally identifiable information, including their Social Security numbers and EDIPI, through a simple URL manipulation. The information was obtained by accessing the "listReviews" endpoint with a specific perID parameter...

CVE-2021-32994 Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer

Softing OPC UA C++ SDK Software Development Kit versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locatio...

massimorossato.it Improper Access Control vulnerability OBB-2452648

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-45810

GlobalProtect-openconnect versions prior to 2.0.0 exclusive are affected by incorrect access control in GPService through DBUS, GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server, the...

bonkebestratingen.nl Improper Access Control vulnerability OBB-2420939

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fotoworksxl.de Improper Access Control vulnerability OBB-2405931

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-15514 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: A high privileged user who has access to transaction SM59 can read connection details stor...