3195 matches found
Cisco Nexus 9000 Series APIC Access Control Vulnerability (CSCut12998)
The remote Cisco Nexus 9000 Series device is affected by an access control vulnerability in the Cisco Application Policy Infrastructure Controller APIC due to a flaw in the eligibility logic of the role-based access control RBAC code. An authenticated, remote attacker can exploit this, via...
Uber: Unauthorized file (invoice) download
Due to an access control vulnerability it was possible to download arbitrary invoices if you had the invoice's UUID. This bug was found internally by the Uber security team previously, so it was closed as a Duplicate...
The vulnerability of clients to universal configuration management databases like USMDB Browser allows attackers to obtain confidential information or circumvent existing access restrictions.
The vulnerability of the client for universal configuration management databases of the USMDB Browser is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating locally, to obtain confidential information or circumvent existing access restrictions...
The vulnerabilities of Adobe Integrated Runtime and Flash Player software allow attackers to circumvent existing access restrictions.
The vulnerability of Adobe Integrated Runtime and Flash Player programs is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow a malicious actor to circumvent existing access restrictions remotely...
MGASA-2014-0160 Updated moodle packages fix multiple security vulnerabilities
Updated moodle package fixes security vulnerabilities: In Moodle before 2.4.9, question strings were not being filtered correctly possibly allowing cross site scripting, as quizquestiontostring can cause invalid HTML CVE-2014-2571. Feedback Availability dates not honored in complete.php in Moodle...
Ammyy Admin 3.2 - Authentication Bypass
Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded option CWE-255. - CVE-2013-5582 for failure...
Thinksns2. 8 file upload exploit exp-vulnerability warning-the black bar safety net
Vulnerability version The presence of vulnerabilities the version: latest 2. 8 stable version. Other version not test. Vulnerability file Vulnerable file is: thumb.php Author: Wei kunpeng 1, Prepare the following PHP file and upload it to the server yourself. File content as follows: ? php echo “...
USN-1709-1: OpenStack Nova vulnerability
Phil Day discovered that nova-volume did not validate access to volumes. An authenticated attacker could exploit this to bypass intended access controls and boot from arbitrary volumes...
CVE-2009-4091
comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete comments via the 1 edit or 2 del action...
CVE-2007-0312
wcSimple Poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password hashes via a direct request for password.txt...
Avaya Argent Office uses weak SNMP authentication mechanism
Overview The Avaya Argent Office does not properly enforce SNMP community string values, resulting in a weakened access control mechanism. Description The Avaya Argent Office does not properly enforce SNMP community string values. It will accept a null string i.e. as a valid community string and...
Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing
source: https://www.securityfocus.com/bid/6915/info A vulnerability has been discovered in the 'Miniserv.pl' script used to invoke both Webmin and Usermin. Due to insufficient sanitization of client-supplied BASE64 encoded input, it is possible to inject a Session ID into the access control list...
Microsoft IIS FTP service searches all trusted domains for user accounts
Overview The Microsoft IIS FTP Service contains a vulnerability that allows remote attackers to log in using domain accounts without providing a specific domain name. Description The Microsoft IIS FTP Service allows users to establish connections using either local accounts or Windows domain...