CVE-2020-5231

Opencast is affected in versions before 7.6 and before 8.1 where users with the non‑standard ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users (not granting ROLE_ADMIN). Root cause: a misconfiguration in security allowing creation by a course admin. Impact: authorization bypas...

CVE-2020-5231 Opencast users with ROLE_COURSE_ADMIN can create new users

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

CVE-2019-5231

The CVE-2019-5231 entry concerns Huawei P30 ELLE-AL00B devices with versions prior to 9.1.0.186 (C00E180R2P1). The vulnerability is an improper authorization issue where an unauthorized action check can be bypassed, potentially letting an attacker update a crafted software package. Affected produ...

CVE-2019-5231

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186C00E180R2P1 have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package...

CVE-2018-5231

CVE-2018-5231: Atlassian Jira’s ForgotLoginDetails resource allows remote denial of service via crafted requests. Affected versions are Jira before 7.6.6; 7.7.0–7.7.3; 7.8.0–7.8.3; and 7.9.0–7.9.1. No remediation details are provided in the connected documents.

Denial of service through the ForgotLoginDetails resource - CVE-2018-5231

The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to perform a denial of service attack via sending requests to it...

Multiple Vulnerabilities Affecting Four Rapid7 Products

Today, we'd like to announce eight vulnerabilities that affect four Rapid7 products, as described in the table below. While all of these issues are relatively low severity, we want to make sure that our customers have all the information they need to make informed security decisions regarding the...

CVE-2017-5231

CVE-2017-5231 affects Rapid7 Metasploit (Meterpreter stdapi CommandDispatcher.cmd_download) where a directory traversal flaw in pre-4.13.0-2017020701 builds allows writing to an arbitrary directory on the Metasploit console with the running process permissions. Connected documents corroborate the...

CVE-2016-5231

Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and delete user data via a crafted app...

CVE-2016-5231

Summary: CVE-2016-5231 affects Huawei Mate 8 and related NXT/NXT variants (NXT-AL, NXT-CL, NXT-DL, NXT-TL) prior to certain build revisions. The issue allows an attacker to bypass permission checks and delete user data via a crafted app. The vulnerability is linked to Huawei’s security advisories...

CVE-2015-5231

The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via 1 process dumps or 2 ptrace access...

CVE-2015-5231

CVE-2015-5231 affects the CRIU service daemon, where it does not properly restrict access to non-dumpable processes. This allows local attackers to obtain sensitive information through (1) process dumps or (2) ptrace access. The vulnerability is consistently described across multiple sources (NVD...

openSUSE Security Update : criu (openSUSE-2015-599)

The systemd service in criu was disabled as a temporary workaround for possibile security issues CVE-2015-5228, CVE-2015-5231, bsc943105 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

CVE-2014-5231

Siemens SIMATIC WinCC Sm@rtClient for iOS (pre-1.0.2) is affected by CVE-2014-5231. The issue stems from Insufficiently Protected Credentials (CWE-522): the app stores its password in storage in a way that could allow a local attacker with physical access to extract it. The ICS advisory notes loc...

VLC Media Player TiVo Demuxer Double Free Vulnerability (Mac OS X)

This host is installed with VLC Media Player and is prone to double free vulnerability. OpenVAS Vulnerability Test $Id: gbvlcmediaplayerdemuxerdoublefreevulnmacosx.nasl 5988 2017-04-20 09:02:29Z teissa $ VLC Media Player TiVo Demuxer Double Free Vulnerability Mac OS X Authors: Antu Sanadi...

CVE-2011-5231

CVE-2011-5231 is a duplicate of CVE-2012-0023. The connected data confirms VLC media player contains a double-free vulnerability in the TiVo demuxer get_chunk_header function (modules/demux/ty.c) affecting VLC 0.9.0–1.1.12, enabling potential remote code execution or crash via crafted TiVo files....

CVE-2011-5231

...

CVE-2012-5231

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

CVE-2012-5231

CVE-2012-5231 affects miniCMS 1.0 and 2.0. The vulnerability arises from improper handling of an executable extension in user-controlled fields (pagename or area) when update.php writes to content/ and in updatenews.php when writing to content/news/. This results in remote attackers being able to...

CVE-2010-5231

CVE-2010-5231 describes an untrusted search path vulnerability in DivX Player 7.2.019 that allows local privilege escalation via a Trojan horse VersionCheckDLL.dll placed in the current working directory, demonstrated by a directory containing a .avi file. The root cause is an DLL search order is...