KMC Controls BAC-5051E Security Bypass Vulnerability

KMC Controls BAC-5051E is a router product for use in building automation systems from KMC Controls, USA. A security vulnerability exists in the KMC Controls BAC-5051E using firmware versions prior to E0.2.0.2. A remote attacker could use this vulnerability to bypass established access restrictio...

FreeBSD : openafs -- multiple vulnerabilities (bcbd3fe0-2b46-11e6-ae88-002590263bf5)

The OpenAFS development team reports : Foreign users can bypass access controls to create groups as system:administrators, including in the user namespace and the system: namespace. The contents of uninitialized memory are sent on the wire when clients perform certain RPCs. Depending on the RPC,...

CVE-2016-4502

Environmental Systems Corporation ESC 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter...

CVE-2016-2016

Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with VxFS 5.0, VxFS 5.0.1, and VxFS 5.1SP1 mishandles ACL inheritance for default:class: entries, default:other: entries, and default:user:...

DEBIAN-CVE-2016-2860

The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID...

HackerOne: Inadequate access controls in "Vote" functionality???

Hello there, First of all let me congratulate you for including pornhub in the list of bug bounty programs, me and my colleagues will have a lot of fun with it hahahahahah. Awesome... Anyways, I stumbled upon something whilst testing hackerone's main site. I don't know if it's a feature that it's...

BMC Server Automation RSCD Agent Weak ACL XML-RPC Arbitrary Command Execution

The RSCD agent running on the remote host does not have access controls in place to prevent an attacker from executing XML-RPC commands. An unauthenticated, remote attacker can exploit this to execute arbitrary commands in the context of the user in which the connections are mapped. C Tenable...

The vulnerability of the PostgreSQL database management system allows attackers to circumvent existing access restrictions.

The vulnerability of the PostgreSQL database management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using a session that executes queries from more than one role...

The vulnerability of microprogrammed software in HP networking switches allows attackers to circumvent existing access restrictions.

The vulnerability of microprogrammed software in HP Networking switches is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder operating locally to circumvent existing access restrictions...

The vulnerability of the ZyXEL PMG5318-B20A router allows a violator to circumvent existing access restrictions.

The vulnerability of the ZyXEL PMG5318-B20A router exists due to the absence of session termination after exiting the system. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using an automated workstation...

UBUNTU-CVE-2016-2313

authlogin.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database...

Lenovo Fingerprint Manager and Touch Fingerprint Privilege Gain Vulnerability

Lenovo Fingerprint Manager and Touch Fingerprint are both products of the Chinese company Lenovo. The former is a set of fingerprint sensor drivers developed for the Thinkpad series; the latter is a set of drivers for acquiring recognized fingerprints. A privilege-acquisition vulnerability exists...

CVE-2016-2171

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to 1 add, 2 edit, or 3 delete users via the REST API...

The vulnerability of the NX-OS network operating system and the Application Policy Infrastructure Controller software allows a perpetrator to circumvent existing access restrictions based on RBAC.

The vulnerability of the NX-OS network operating system and the Application Policy Infrastructure Controller software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions using a...

The vulnerability of the Firefox browser allows a perpetrator to obtain confidential information or circumvent existing access restrictions policies.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions or obtain confidential information by accessing the Content Security Policy violation report...

The vulnerability of the Apache Tomcat application server allows attackers to bypass access restrictions and execute arbitrary HTTP requests.

The vulnerability of the Apache Tomcat application server is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access restrictions and read arbitrary HTTP requests through a specially created web application...

The vulnerability of the Moodle learning management system allows a hacker to bypass existing access restrictions.

The vulnerability of the mod/forum/post.php function in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions through group-based authenticatio...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions.

The vulnerability of Google Chrome’s Extensions subsystem is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using specially crafted JavaScript code related to functions in files...

The vulnerability of the Moodle learning management system allows a hacker to bypass existing access restrictions.

The vulnerability of the Moodle learning management system’s module selection involves deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions by visiting a specific URL to add or delete answers in a closed state...

openafs -- multiple vulnerabilities

The OpenAFS development team reports: Foreign users can bypass access controls to create groups as system:administrators, including in the user namespace and the system: namespace. The contents of uninitialized memory are sent on the wire when clients perform certain RPCs. Depending on the RPC, t...