Filtered by CWE-639
Filtered by vendor Subscriptions
Total 712 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-30956 1 Palantir 1 Foundry Comments 2024-11-21 5.3 Medium
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.
CVE-2023-30550 1 Metersphere 1 Metersphere 2024-11-21 6.8 Medium
MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some operating permissions. The issue has been fixed in version 2.9.0.
CVE-2023-30216 1 Newbee-mall Project 1 Newbee-mall 2024-11-21 5.4 Medium
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.
CVE-2023-2978 1 Abstrium 1 Pydio Cells 2024-11-21 4.6 Medium
A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
CVE-2023-2958 1 Orjinyazilim 1 Ats Pro 2024-11-21 9.8 Critical
Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass.This issue affects ATS Pro: before 20230714.
CVE-2023-2883 1 Cbot 2 Cbot Core, Cbot Panel 2024-11-21 8.8 High
Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
CVE-2023-2844 1 Fit2cloud 1 Cloudexplorer Lite 2024-11-21 4.9 Medium
Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
CVE-2023-2713 1 Rental Module Project 1 Rental Module 2024-11-21 9.8 Critical
Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15.
CVE-2023-2702 1 Finexmedia 1 Competition Management System 2024-11-21 8.8 High
Authorization Bypass Through User-Controlled Key vulnerability in Finex Media Competition Management System allows Authentication Abuse, Authentication Bypass.This issue affects Competition Management System: before 23.07.
CVE-2023-2548 1 Metagauss 1 Registrationmagic 2024-11-21 6.6 Medium
The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers, with administrator-level permissions and above, to change user passwords and potentially take over super-administrator accounts in multisite setup.
CVE-2023-2544 1 Upv 1 Peix 2024-11-21 5.3 Medium
Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users.
CVE-2023-2276 1 Wclovers 1 Wcfm Membership 2024-11-21 9.8 Critical
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
CVE-2023-2260 1 Alf 1 Alf 2024-11-21 8.8 High
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVE-2023-2190 1 Gitlab 1 Gitlab 2024-11-21 6.5 Medium
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.
CVE-2023-2065 1 Armoli 1 Cargo Tracking System 2024-11-21 8.8 High
Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authentication Abuse, Authentication Bypass.This issue affects Cargo Tracking System: before 3558f28 .
CVE-2023-28686 3 Debian, Dino, Fedoraproject 3 Debian Linux, Dino, Fedora 2024-11-21 7.1 High
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
CVE-2023-28656 1 F5 3 Nginx Api Connectivity Manager, Nginx Instance Manager, Nginx Security Monitoring 2024-11-21 8.1 High
NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2023-28481 1 Tigergraph 1 Tigergraph 2024-11-21 8.8 High
An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key.
CVE-2023-28334 1 Moodle 1 Moodle 2024-11-21 4.3 Medium
Authenticated users were able to enumerate other users' names via the learning plans page.
CVE-2023-28109 1 Play-with-docker 1 Play With Docker 2024-11-21 6.5 Medium
Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configuration was not correct, an attacker could use `play-with-docker.com` as an example and set the origin header in an http request as `evil-play-with-docker.com`. The domain would echo in response header, which successfully bypassed the CORS policy and retrieved basic user information. This issue has been fixed in commit ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a. There are no known workarounds.