CVE-2018-16178

Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function...

CVE-2018-16178

Cybozu Garoon versions 3.0.0–4.10.0 contain an authentication restriction bypass via the Single Sign-On function (CWE-284). An attacker who can access the product may bypass authentication and view information intended for signed-on users. The issue was addressed in Cybozu Garoon 4.10.1; updating...

CVE-2018-16197

The CVE-2018-16197 issue affects Toshiba Home gateway models HEM-GW16A and HEM-GW26A (firmware versions 1.2.9 and earlier). Affected component: gateway firmware with improper access control (CWE-284) that enables an attacker on the same network segment to bypass access restrictions and access inf...

Microsoft Windows Data Sharing Service CVE-2019-0573 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attackers may exploit this issue to gain elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windo...

Stripe API Access Restriction Bypass Vulnerability

Stripe is a set of online payment platforms from Stripe Inc. in the U.S. Stripe API is one of the application program interfaces. An access restriction bypass vulnerability exists in Stripe API version 1, which can be exploited by remote attackers to bypass access restrictions...

PT-2019-6068 · Wayang · Wayang-Cms

Name of the Vulnerable Software and Affected Versions: Wayang-CMS version 1.0 Description: A cross-site scripting XSS issue in the index.php file of Wayang-CMS allows attackers to execute arbitrary web scripts or HTML by adding a specially crafted X-Forwarded-For field to the header. This can...

CVE-2018-1000624

Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality. By visiting http://V2IHUB/UI/powerdown.php, a remote attacker could exploit this vulnerability to shut down the system...

Apache Traffic Server ESI Plugin Cookie Header Information Disclosure (CVE-2018-8040)

An information disclosure vulnerability exists in Apache Traffic Server. The vulnerability is due to improper restriction of access to the Cookie HTTP header within the ESI plugin. Successful exploitation of this vulnerability could lead to disclosure of sensitive information...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

sssd, versions 1.13.0 to before 2.0.0, did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. Sensitive information could be inadvertently disclosed to local attackers if it was stored in the user directory. Mitigation This vulnerability is only...

PT-2023-15166 · Unknown +2 · Gpac Mp4Box +2

Name of the Vulnerable Software and Affected Versions: GPAC MP4box version 2.1-DEV-rev574-g9d5bb184b Description: The issue is related to a heap use-after-free vulnerability. It occurs via the file filters/dmx m2ts.c at line 470 in the m2tsdmx declare pid function. This vulnerability can be...

Access Restriction Bypass

wordpress is vulnerable to Access Restriction Bypass. The vulnerability exists because it can leads to unauthorized deletion of files just by manipulating metadata...

WordPress WP Maintenance Mode Plugin Access Restriction Bypass Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WP Maintenance Mode Plugin is used in one of the site maintenance page settings plugin. WordPress WP Maintenanc...

RATELIMITED: Information Disclosure PHPpgAdmin

PHPpgAdmin is a piece of script which allows system administrators to manage their Postgres databases easily from a webUI. We had forgotten to limit access to this script, resulting in the ability for a brute-force attack to happen...

CVE-2018-19003

The CVE-2018-19003 issue affects GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e with versions listed in the advisories (e.g., Mark VIe 03.03.28C–05.02.04C; EX2100e/EX2100e_Reg/LS2100e prior to v04.09.00C). Root cause: improper limitation of a pathname to a restricted directory (path traversal), a...

SUSE-SU-2018:4090-1 Security update for ghostscript

This update for ghostscript to version 9.26 fixes the following issues: Security issues fixed: - CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c bsc1117327 - CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c bsc1117313 - CVE-2018-19477:...

RATELIMITED: Open Directory

Summary: A misconfigured server can show a directory listing, which could potentially yield sensitive information to an attacker. Solution : 1. Disable directory listings in the web- or application-server configuration by default. 2. Restrict access to unnecessary directories and files. 3. Create...

[ASA-201812-9] firefox: multiple issues

Arch Linux Security Advisory ASA-201812-9 ========================================= Severity: Critical Date : 2018-12-12 CVE-ID : CVE-2018-12405 CVE-2018-12406 CVE-2018-12407 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18495 CVE-2018-18497 Package : firefox Type : multipl...

CVE-2018-2503

The CVE-2018-2503 entry concerns SAP NetWeaver AS Java keystore service, where access to protected resources was not sufficiently restricted, enabling information disclosure. Public documents confirm this vulnerability exists in the SAP NetWeaver AS Java keystore service and that the issue has be...