| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. |
| Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
| Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
| Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network. |
| Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network. |
| Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. |
| Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
| Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests. |
| In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3. |
