Sangho Lee

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.

Incorrectly configured access control security levels allow for unauthorized access due to a missing capability check in a function. This enables unauthenticated attackers to perform unauthorized actions.

Incorrectly configured access control security levels allow unauthenticated attackers to perform unauthorized actions. This is caused by a missing capability check within a function, leading to a missing authorization issue.

A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator. This issue is related to the implementation of TLS and SSL protocols in Mbed TLS, allowing an attacker to access confidential data.

The issue is related to a side channel in modular exponentiation, which could disclose an RSA private key used in a secure enclave. This is due to a dependency of the instruction timing on the instruction data, allowing a remote attacker to access confidential data.

A side channel issue allows the recovery of an ECC private key. This is related to functions such as `mbedtls ecp check pub priv`, `mbedtls pk parse key`, `mbedtls pk parse keyfile`, `mbedtls ecp mul`, and `mbedtls ecp mul restartable`. The issue can be exploited by a remote attacker to gain access to confidential data.