Improper Protection of Alternate Path

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i

• Без аутентификации

yiiframework · yii9 апр. 2025 г.

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running

• Без аутентификации

vbulletin · vbulletin27 мая 2025 г.

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.

• pre-auth RCE

vbulletin · vbulletin27 мая 2025 г.

A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (

siemens · himed cockpit 12 pro8 окт. 2024 г.

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upl

cisco · identity services engine21 нояб. 2023 г.

Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell

• Локальное повышение привилегий

docker · docker desktop25 сент. 2023 г.

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

• Без аутентификации

ash-project · ash_lua7 сент. 2026 г.

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use t

openstack · ironic10 июл. 2026 г.

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching works

• Без аутентификации

pcre · pcre25 сент. 2026 г.

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE

crewai · crewai13 сент. 2026 г.

ABB PB610 HMIStudio accepts malicious DLL file in an application

abb · pb610 panel builder 60018 дек. 2019 г.

KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened

• Локальное повышение привилегий

kioware · kioware14 мая 2024 г.

IBM MQ privilege escalation

• Локальное повышение привилегий

ibm · mq appliance2 нояб. 2023 г.

PB610 HMISimulator provides interface with access to arbitrary files

• Без аутентификации

abb · pb610 panel builder 60018 дек. 2019 г.

Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass

paloaltonetworks · prisma browser13 мая 2026 г.

In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing

kioware · kioware14 мая 2024 г.

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged con

• Локальное повышение привилегий

docker · docker desktop13 мар. 2023 г.

Privilege Management for Windows - Elevation of Privilege

• Локальное повышение привилегий

beyondtrust · privilege management for windows28 июл. 2025 г.

Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false

• Без аутентификации

apache · tika30 июл. 2026 г.

2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424

dominionvoting · imagecast x24 июн. 2022 г.

AWS API MCP File Access Restriction Bypass

amazon · aws api mcp server16 мар. 2026 г.

Improper Protection of Alternate Path in GitLab

gitlab · gitlab12 сент. 2024 г.

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

gitea · gitea open source git server13 авг. 2026 г.

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.

arris · vip11132 июн. 2025 г.

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

• Без аутентификации

ash-project · ash_authentication_oauth2_server7 сент. 2026 г.