CVE-2013-4090

CVE-2013-4090 concerns the Varnish HTTP cache before 3.0.4, due to an ACL bug in the access control logic. Affected component is the Varnish ACL handling in versions prior to 3.0.4. The practical impact is an integrity issue (I:H in CVSS v3.1) with potentially improper access control, as indicate...

CVE-2013-4090

Varnish HTTP cache before 3.0.4: ACL bug...

CVE-2013-4090

Varnish HTTP cache before 3.0.4: ACL bug...

Unspecified vulnerability in MISP (CNVD-2020-16092)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.121, which stems from the...

CVE-2020-8894

CVE-2020-8894 concerns MISP before 2.4.121, where ACLs for discussion threads were mishandled in the code paths of ThreadsController.php and Thread.php. The vulnerability arises from improper access control logic, enabling potential permission misconfigurations or exposure of thread discussions d...

CVE-2019-10127

The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL...

Authorization Bypass

github.com/hashicorp/nomad is vulnerable to authorization bypass. The vulnerability exists as the allocation endpoints improperly performs ACL checks on the requested namespace...

CVE-2020-7955

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3...

CVE-2020-7955

HashiCorp Consul and Consul Enterprise versions 1.4.1–1.6.2 did not uniformly enforce ACLs across all API endpoints, potentially enabling information disclosure. Root cause: inconsistent ACL enforcement leading to exposure of information via multiple API endpoints. Impact: partial confidentiality...

[20200303] - Core - Incorrect Access Control in com_templates

Various actions in comtemplates lack the required ACL checks, leading to various potential attack vectors...

openSUSE Security Update : samba (openSUSE-2020-122)

This update for samba fixes the following issues : Security issues fixed : - CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing bsc1160888. - CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not...

OPENSUSE-SU-2020:0122-1 Security update for samba

This update for samba fixes the following issues: Security issues fixed: - CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing bsc1160888. - CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not...

MGASA-2020-0058 Updated samba packages fix security vulnerabilities

The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers CVE-2019-14902. When processing untrusted string input Samba can read past the end of the allocated buffer when printing a...

Updated samba packages fix security vulnerabilities

The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers CVE-2019-14902. When processing untrusted string input Samba can read past the end of the allocated buffer when printing a...

CVE-2019-17190

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

Privilege escalation

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

CVE-2019-17190

A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe which is running as NT AUTHORITY\SYSTEM when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, th...

CVE-2019-17190

CVE-2019-17190 affects Avast Secure Browser 76.0.1659.101. The issue is an insecure ACL on Update.ini in %PROGRAMDATA%\Avast Software\Browser\Update, altered by AvastBrowserUpdate.exe running as NT AUTHORITY\SYSTEM during update checks. A low-privileged user can create a hard link Update.ini to a...

FreeBSD : samba -- multiple vulnerabilities (5f0dd349-40a2-11ea-8d8c-005056a311d1)

The Samba Team reports : CVE-2019-14902 The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers. CVE-2019-14907 When processing untrusted string input Samba can read past the end of t...

Samba 4.x < 4.9.18 / 4.10.x < 4.10.12 / 4.11.x < 4.11.5 Multiple Vulnerabilities

The version of Samba running on the remote host is 4.x prior to 4.9.18, 4.10.x prior to 4.10.12, or 4.11.x prior to 4.11.5. It is, therefore, affected by multiple vulnerabilities: - An issue exists with ACL inheritance due to added or removed delegated rights not being inherited across domain...