5684 matches found
CVE-2021-43998: Incorrect Permission Assignment for Critical Resource
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...
Apache Ozone Access Control Error Vulnerability (CNVD-2021-91628)
Apache Ozone is an application. An accessible control error vulnerability exists in Apache Ozone, which stems from the product's failure to add valid permission checks for users. An attacker could bypass ACL checks to access sensitive information through this vulnerability...
CVE-2021-39234
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...
CVE-2021-39234
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...
CVE-2021-39234 Raw block data can be read bypassing ACL/authorization
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...
CVE-2021-39234: Improper Input Validation
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...
SUSE-SU-2021:3722-1 Security update for libarchive
This update for libarchive fixes the following issues: - CVE-2019-19221: Fixed out-of-bounds read caused by incorrect mbrtowc or mbtowc call bsc1157569 - backporting symlink security fixes from 3.5.2: - extracting with ACLs modifies ACLs of target bsc1192425 - modifies file flags of target...
CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:4191)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4191 advisory. - QEMU: net: e1000e: use-after-free while sending packets CVE-2020-15859 - QEMU: slirp: invalid pointer initialization may lead to information disclosu...
pacemaker security update
1.1.23-1.0.1 - Upstream reference in pacemaker crmreport binary Orabug: 31611300 1.1.23-1.1 - Prevent ACL bypass CVE-2020-25654 - Resolves: rhbz1892140...
NewStart CGSL CORE 5.05 / MAIN 5.05 : pacemaker Vulnerability (NS-SA-2021-0160)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pacemaker packages installed that are affected by a vulnerability: - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with...
CVE-2021-34787 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability
A vulnerability in the identity-based firewall IDFW rule processing feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper...
CVE-2021-34787
Cisco ASA/FTD IDFW rule-bypass (CVE-2021-34787) affects Identity-Based Rule Processing in ASA Software and FTD. Affected devices that use object group search may mishandle certain network requests, allowing an unauthenticated remote attacker to bypass ACLs and security protections, potentially se...
CVE-2021-34787
A vulnerability in the identity-based firewall IDFW rule processing feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper...
CVE-2021-34787: Permissive List of Allowed Inputs
A vulnerability in the identity-based firewall IDFW rule processing feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper...
Oracle Linux 8 : redis:6 (ELSA-2021-3945)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3945 advisory. - fix denial of service via Redis Standard Protocol RESP request CVE-2021-32675 - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 ...
Oracle Linux 8 : redis:5 (ELSA-2021-3918)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3918 advisory. - fix denial of service via Redis Standard Protocol RESP request CVE-2021-32675 - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 ...
CVE-2021-26557
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access...
CVE-2021-26556
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access...
staff.cornwall-acl.ac.uk Cross Site Scripting vulnerability OBB-2158078
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2021-32627
An integer overflow issue was found in redis. The vulnerability involves changing the default "proto-max-bulk-len" and "client-query-buffer-limit" configuration parameters to very large values and constructing specially crafted large stream elements. This flaw allows a remote attacker to corrupt...