74 matches found
Privilege escalation
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...
CVE-2020-11980
CVE-2020-11980 affects Apache Karaf JMX where JAAS-based authentication and ACL-based authorization allow a non-admin with a viewer role to call get* via etc/jmx.acl.cfg, potentially triggering getMBeansFromURL to fetch MBeans remotely and register them, enabling SSRF-like behavior and MBean regi...
SUSE-SU-2017:2716-1 Security update for the Ruby on Rails stack
This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and improvements from upstream. The following security issues have been fixed by upstream: rubygem-actionpack-42 - CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby...
Debian: Security Advisory (DSA-3168-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cdsagenda <= 4.2.9 (SendAlertEmail.php) File Include Vulnerability
No description provided by source. ToXiC Cdsagenda 4.2.9 Remote File Inclusion by ToXiC CreW ToXic Security Italian CreW BuG FounD by Drago84 Application Affect: Cdsagenda 4.2.9 Sorce Code: http://cdsware.cern.ch/cdsagenda/download/cdsagenda-4.2.9.tar.gz Page: SendAlertEmail.php Dir :...
Fedora 19 : bugzilla-4.2.9-1.fc19 (2014-5414)
Previous versions of bugzilla had the following security issues : - The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. - Dangerous control characters can be inserted into Bugzilla, notably into bug comments, which can...
Design/Logic Flaw
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control RBAC restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing...
VulnCheck KEV: CVE-2011-0227
The queueing primitives in IOMobileFrameBuffer in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 do not properly perform type conversion, which allows local users to gain privileges via a crafted application...
VulnCheck KEV: CVE-2011-0226
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a...
Apple Releases iOS 4.3.4 and iOS 4.2.9
Apple has released iOS 4.3.4 for the iPhone GSM model, iPod touch, and iPad, and iOS 4.2.9 for the iPhone CDMA model to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or operate with escalated privileges. US-CERT encourages users and...
APPLE-SA-2011-07-15-2 iOS 4.2.9 Software Update for iPhone
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-07-15-2 iOS 4.2.9 Software Update for iPhone iOS 4.2.9 Software Update for iPhone is now available and addresses the following: CoreGraphics Available for: iOS 4.2.5 through 4.2.8 for iPhone 4 CDMA Impact: Viewing a maliciously crafted P...
Cdsagenda 4.2.9 - SendAlertEmail.php File Inclusion
Cdsagenda 4.2.9 - SendAlertEmail.php File Inclusion ToXiC Cdsagenda 4.2.9 Remote File Inclusion by ToXiC CreW ToXic Security Italian CreW BuG FounD by Drago84 Application Affect: Cdsagenda 4.2.9 Sorce Code: http://cdsware.cern.ch/cdsagenda/download/cdsagenda-4.2.9.tar.gz Page: SendAlertEmail.php...
phpMyConferences <= 8.0.2 Remote File Inclusion
ToXiC Cdsagenda 4.2.9 Remote File Inclusion by ToXiC CreW ToXic Security Italian CreW BuG FounD by Drago84 Application Affect: Cdsagenda 4.2.9 Sorce Code: http://cdsware.cern.ch/cdsagenda/download/cdsagenda-4.2.9.tar.gz Page: SendAlertEmail.php Dir : /cdsagenda-4.2.9/htdocs/modification/ Problem:...
Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion
ToXiC Cdsagenda 4.2.9 Remote File Inclusion by ToXiC CreW ToXic Security Italian CreW BuG FounD by Drago84 Application Affect: Cdsagenda 4.2.9 Sorce Code: http://cdsware.cern.ch/cdsagenda/download/cdsagenda-4.2.9.tar.gz Page: SendAlertEmail.php Dir : /cdsagenda-4.2.9/htdocs/modification/ Problem:...