CVE-2020-3360: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

PT-2020-2964

Name of the Vulnerable Software and Affected Versions Cisco IP Phones Series 7800 and Series 8800 affected versions not specified Description A vulnerability in the Web Access feature could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This issue i...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13850: Direct Request

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

PT-2020-13730

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS version 7.44 Description The issue is related to inadequate access controls on a web folder. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

Brizy - Page Builder < 1.0.126 - Improper Access Controls on AJAX Calls

The plugin does not properly check for access controls on AJAX calls, resulting in authenticated user with low privileges being able to gain access to the editor functions...

Portal Component Unauthorized Access

The vulnerability of the Portal component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using...

Cisco IOS XE Code Issue Vulnerability

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A code issue vulnerability exists in the Web UI in Cisco IOS XE Software, which stems from the presence of a proxy service on a specific endpoint of the UI. An attacker could explo...

Joomla! cross-site scripting vulnerability (CNVD-2020-53800)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in versions of Joomla! prior to 3.9.19, which stems from a default setting in the global text filter...

Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass

Crystal Shard http-protection version 0.2.0 suffers from an IP spoofing bypass vulnerability. Exploit Title : Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass Exploit Author : Halis Duraki @0xduraki Date : 2020-05-28 Product : http-protection Crystal Shard Product URI :...

Oracle Coherence CacheStore Unauthorized Access

The vulnerability of the Caching, CacheStore, and Invocation components of the Oracle Coherence data processing software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information through the HT...

Oracle Hyperion Financial Reporting Web Based Report Designer Unauthorized Access

The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application for automating budget management processes is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protect...

ABB Central Licensing System

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Central Licensing System CLS Vulnerabilities: Information Exposure; Improper Restriction of XML External Entity Reference; Uncontrolled Resource Consumption; Permissions, Privilege,...

IP-in-IP protocol routes arbitrary traffic by default

Overview IP Encapsulation within IP RFC2003 IP-in-IP can be abused by an unauthenticated attacker to unexpectedly route arbitrary network traffic through a vulnerable device. Description IP-in-IP encapsulation is a tunneling protocol specified in RFC 2003 that allows for IP packets to be...

HTTP Request Smuggling

puma is vulnerable to HTTP request smuggling. By using an invalid Transfer-Encoding header, an attacker is able to smuggle an HTTP request to bypass access controls and obtain confidential information...

Ubuntu: Security Advisory (USN-4355-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4355-1 pulseaudio vulnerability

PulseAudio in Ubuntu contains additional functionality to mediate audio recording for snap packages and it was discovered that this functionality did not mediate PulseAudio module unloading. An attacker-controlled snap with only the audio-playback interface connected could exploit this to bypass...

USN-4355-1: PulseAudio vulnerability

PulseAudio in Ubuntu contains additional functionality to mediate audio recording for snap packages and it was discovered that this functionality did not mediate PulseAudio module unloading. An attacker-controlled snap with only the audio-playback interface connected could exploit this to bypass...