Improper Authorization in cobbler/cobbler

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

Improper Authorization in webmin/webmin

Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

Improper Access Control to Remote Code Execution in webmin/webmin

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

Improper Authorization in orchardcms/orchardcore

Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Improper Access Control (IDOR) in dolibarr/dolibarr

Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.

Improper Access Control in chocobozzz/peertube

Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.

Improper Authorization in librenms/librenms

Improper Authorization in Packagist librenms/librenms prior to 22.2.0.

Improper Access Control in publify/publify

Improper Access Control in GitHub repository publify/publify prior to 9.2.8.

Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover

The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

Improper Authorization in janeczku/calibre-web

Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.

Improper Access Control in janeczku/calibre-web

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

kernel: possible privileges escalation due to missing TLB flush

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

Improper Access Control in janeczku/calibre-web

Improper Access Control in Pypi calibreweb prior to 0.6.16.

Improper header sanitization in bored-agent causes escalation of privilege

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.

Improper Access Control in crater-invoice/crater

Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.

Improper Access Control in chocobozzz/peertube

peertube is vulnerable to Improper Access Control