Authentication flaw

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors...

CVE-2018-0573

The CVE-2018-0573 issue affects baserCMS versions 4.1.0.1 and earlier, and 3.0.15 and earlier, enabling a remote attacker to bypass access restrictions and view files uploaded by a site user due to a failure to restrict access (CWE-264). Multiple sources (NVD, JVN, GHSA, OSV, CNVD) consistently d...

CVE-2018-0567

Cybozu Office 10.0.0 to 10.8.0 is affected by CVE-2018-0567, an operation restriction bypass that allows a user (authenticated) to access and write data before it becomes public. The issue is documented across multiple sources (e.g., JVN/CNVD/OpenVAS/NVD) and is classified with a CVSS v3 base sco...

CVE-2018-0575

CVE-2018-0575 affects baserCMS 4.1.0.1 and earlier, and 3.0.15 and earlier. The vulnerability allows remote attackers to bypass access restrictions in the mail form and view files uploaded by a site user via unspecified vectors. Connected sources confirm multiple vulnerabilities in baserCMS with ...

CVE-2018-0575

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors...

CVE-2018-0567

Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors...

CVE-2018-0572

CVE-2018-0572 affects baserCMS 4.1.0.1 and earlier, and 3.0.15 and earlier. The vulnerability is an access control bypass in the contents management function that could let remote authenticated attackers view or alter restricted content via unspecified vectors. The connected advisories corroborat...

[ASA-201806-12] cantata: multiple issues

Arch Linux Security Advisory ASA-201806-12 ========================================== Severity: High Date : 2018-06-20 CVE-ID : CVE-2018-12559 CVE-2018-12560 CVE-2018-12561 CVE-2018-12562 Package : cantata Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-721 Summary...

PT-2018-1938 · Phpmyadmin +2 · Phpmyadmin +2

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 4.8.0 through 4.8.1 Description: An issue was discovered in phpMyAdmin where an attacker can include and potentially execute files on the server due to improper testing for whitelisted pages during page redirection and...

Security Bulletin: Samba vulnerability issue on SONAS (CVE-2013-4408 and CVE-2012-6105)

Summary An attacker could gain privileged access to SONAS system by exploiting a vulnerability in Samba. Vulnerability Details CVE ID: CVE-2013-4408 and CVE-2012-6105 DESCRIPTION: This issue affects only those SONAS systems that use Active Directory server for authentication. Configuration with...

Security Bulletin: IBM TRIRIGA Application Platform Reports Privilege Escalation (CVE-2017-1373)

Summary IBM TRIRIGA Application Platform Reports are vulnerable to a privilege escalation attack. Vulnerability Details CVEID: CVE-2017-1373 DESCRIPTION: Reports executed in the IBM TRIRIGA Application platform contains a vulnerability that could allow an authenticated user to execute a report th...

Security Bulletin: Internal service types can be invoked in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) Process Portal (CVE-2015-0110)

Summary When invoking a service using the executeServiceByName URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. Vulnerability Details CVEID: CVE-2015-0110 DESCRIPTION: IBM Business Process Manag...

Security Bulletin: Missing access restriction on service types in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (CVE-2014-4758)

Summary When invoking a service using the callService URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. Vulnerability Details CVE ID: CVE-2014-4758 DESCRIPTION: IBM Business Process Manager and...

PT-2018-3862 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.17.4 Description: The issue is related to an integer overflow in the uvesafb setcmap function, which could allow local attackers to crash the kernel or potentially elevate privileges. This is because kmalloc...

Access Restriction Bypass

Mosquitto is vulnerable to access restriction bypass. It does not perform ACL check for the clients with clientid or username including symbols or + when pattern based ACLs is used...

[ASA-201806-4] chromium: access restriction bypass

Arch Linux Security Advisory ASA-201806-4 ========================================= Severity: High Date : 2018-06-07 CVE-ID : CVE-2018-6148 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-712 Summary ======= The package chromium before...

PT-2018-3597 · Mysql Server +8 · Mysql Client +8

Name of the Vulnerable Software and Affected Versions: MySQL Client versions 5.7.32 and prior MySQL Client versions 8.0.22 and prior Description: The issue is related to the C API component of the MySQL Client product, which allows an unauthenticated attacker with network access via multiple...

Access Restriction Bypass

drupal is vulnerable to access restriction bypass. The bypass is possible because Settings Tray module lack a correct check for permission to update certain data...

Access Restriction Bypass

drupal is vulnerable to access restriction bypass. The bypass is possible because it uses the default fallback for access queries while using node access controls with a multilingual site, leading to the bypass of access restriction...

PT-2018-10598 · Windscribe +1 · Windscribe +1

Name of the Vulnerable Software and Affected Versions: Windscribe version 1.81 Description: The issue concerns the VPN component in Windscribe, which uses the OpenVPN client and creates a system process named WindScribeService.exe. This process establishes a named pipe endpoint,...