CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-15412

The CVE-2020-15412 issue affects MISP 2.4.128 where app/Controller/EventsController.php lacks an event ACL check before allowing a user to submit an event contact form. This is reported across multiple sources (NVD entry and RH/CVE detail) and framed as an ACL authorization flaw in the event subm...

CVE-2020-15411

CVE-2020-15411 affects MISP 2.4.128; the vulnerability stems from insufficient ACL checks in the file app/Controller/AttributesController.php within the Attachment Downloader. The NVD entry shows a CVSSv3.1 base score of 9.8 (CRITICAL) with network attack, no privileges required, no user interact...

CVE-2020-15411

An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...

CVE-2020-15411: Undefined Security Weakness

An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...

Joomla! 2.5.x < 3.9.17 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.17. It is, therefore, affected by multiple vulnerabilities : - Incorrect ACL checks in the access level section of comusers allow the unauthorized deletion of usergroups...

Joomla! 1.7.x < 3.9.16 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.7.x prior to 3.9.16. It is, therefore, affected by multiple vulnerabilities : - Missing token checks in the image actions of comtemplates causes CSRF vulnerabilities. CVE-2020-10241 - Inadequate...

Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (cisco-sa-xracl-zbWSWREt)

An authentication bypass vulnerability exists in Cisco IOS XR Software due to a logic error, which prevents the ACL from working when applied against the standby route processor management interface. An unauthenticated, remote attacker can exploit this by attempting to access the device through t...

CVE-2020-11980

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...

CVE-2020-14969

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

CVE-2020-14969

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

Code injection

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

CVE-2020-14969

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

CVE-2020-14969

In MISP 2.4.127, the file app/Model/Attribute.php lacks an ACL lookup on attribute correlations when using the attribute restsearch API, exposing metadata about a correlating but unreachable attribute. This is a validation/authorization oversight that can reveal sensitive linkage information thro...

CVE-2020-3364

A vulnerability in the access control list ACL functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management...

CVE-2020-3364 Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

A vulnerability in the access control list ACL functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management...

CVE-2020-3364

CVE-2020-3364 concerns Cisco IOS XR Software’s standby route processor (RSP) Gigabit Ethernet Management interface. A logic error in the ACL functionality prevents ACLs from filtering traffic on the standby RSP management interface, allowing an unauthenticated, remote attacker to reach configured...

Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

A vulnerability in the access control list ACL functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management...

CVE-2020-11980

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...

CVE-2020-11980

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...