CVE-2024-20291

A vulnerability in the access control list ACL programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. This vulnerability is...

[SECURITY] [DSA 5610-1] redis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5610-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 29, 2024 https://www.debian.org/security/faq -...

CVE-2024-20263

A vulnerability with the access control list ACL management within a stacked switch configuration of Cisco Business 250 Series Smart Switches and Business 350 Series Managed Switches could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected...

GHSA-897W-JV7J-6R7G OroCRMCallBundle has incorrect call view page visibility

Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks...

CVE-2023-32062

CVE-2023-32062 affects OroPlatform/OroCalendarBundle where back-office users can access information from any system calendar event due to insufficient ACL checks. The issue is described across multiple sources (including Veracode and RH Red Hat) as an improper access control vulnerability in the ...

Cisco IOS XR Software Access Control List Bypass (cisco-sa-dnx-acl-PyzDkeYF)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software AnyConnect Access Control List Bypass Vulnerabilities

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

GLSA-202309-09 : Pacemaker: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202309-09 Pacemaker: Multiple Vulnerabilities - A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with...

Cisco IOS XR Software Compression ACL Bypass (cisco-sa-comp3acl-vGmp6BQ3)

According to its self-reported version, Cisco IOS XR is affected by an ACL bypass vulnerability. An unauthenticated, remote attacker can exploit this, to access trusted networks that the device might be protecting. Please see the included Cisco BID and Cisco Security Advisory for more information...

Vulnerabilities fixed in Cisco IOS XR

Cisco has fixed vulnerabilities in IOS XR. A unauthenticated malicious party could exploit the vulnerabilities to cause a denial-of-service, or to bypass existing ACLs bypassing them by sending specially prepared network traffic. Cisco has also fixed vulnerabilities that allow a local,...

Cisco IOS XR Software Compression ACL Bypass Vulnerability

A vulnerability in the classic access control list ACL compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range...

Redis ACL Bypass Vulnerability (GHSA-q4jr-5p56-4xwc)

Redis is prone to an ACL bypass vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if description...

Oracle Linux 7 : pacemaker (ELSA-2020-5453)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5453 advisory. - Prevent ACL bypass CVE-2020-25654 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

FreeBSD : redis -- Possible bypassing ACL configuration (6c72b13f-4d1d-11ee-a7f1-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c72b13f-4d1d-11ee-a7f1-080027f5fec9 advisory. - Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed...

CVE-2022-43684

ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...

Authorization

ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...

CVE-2022-43684 ACL bypass in Reporting functionality

ServiceNow has released patches and an upgrade that address an Access Control List ACL bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: Quebec prior to Patch 10 Hot Fix 8b Rome prior to Patch 10 Hot Fix 1 San...

CVE-2022-43684

CVE-2022-43684 describes an ACL bypass in ServiceNow Core functionality. Affected: ServiceNow Quebec (before Patch 10 Hot Fix 8b), Rome (before Patch 10 Hot Fix 1), San Diego (before Patch 7), Tokyo (before Tokyo Patch 1), and Utah (before Utah GA). Impact: authenticated users could access sensit...

CVE-2023-32007 Apache Spark: Shell command injection via Spark UI

UNSUPPORTED WHEN ASSIGNED The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

Privilege Escalation

github.com/hashicorp/nomad is vulnerable to Privilege Escalation. Unauthenticated HTTP requests could bypass ACL authorizations when processed on servers through internal RPCs, allowing a job to be submitted to the cluster without mTLS enabled, which elevates user privileges...