7228 matches found
U.S. Dept Of Defense: SharePoint exposed web services
Microsoft SharePoint is a web application platform developed by Microsoft. Because of improper configuration an anonymous user has access to the SharePoint Web Services. The impact of this vulnerability The SharePoint Web Services can disclose sensitive information. This information can be used t...
PT-2017-3585 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.14.13 Description: The issue is related to errors in resource management within the Parallel Crypto Engine crypto/pcrypt.c subsystem of the Linux operating system. It can be exploited by executing a specially...
BlogoText 'validate_form_preferences' function access restriction bypass vulnerability
BlogoText is a lightweight SQLite blogging engine. An access restriction bypass vulnerability exists in the 'validateformpreferences' function in the admin/preferences.php file in BlogoText 3.7.6 and earlier versions. An attacker can exploit this vulnerability to bypass access restrictions...
Conarc iChannel webserver incorrect access restriction vulnerability
Conarc iChannel is a solution developed by Conarc Corporation in the United States that integrates customer relationship management CRM systems with DMS functionality. An incorrect access restriction vulnerability exists in Conarc iChannel. A remote attacker could exploit this vulnerability by...
CVE-2017-3184
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unauthenticated, remote attacker can exploit this vulnerability by directly accessing the...
CVE-2017-16787
The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...
Design/Logic Flaw
The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...
PT-2017-14826 · Ecmwf +1 · Metview +1
Name of the Vulnerable Software and Affected Versions: Metview version 4.7.3 Description: The issue concerns a lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...
[ASA-201712-6] qt5-webengine: multiple issues
Arch Linux Security Advisory ASA-201712-6 ========================================= Severity: Critical Date : 2017-12-13 CVE-ID : CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15390 CVE-2017-15392 CVE-2017-15394 CVE-2017-5124 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129...
[ASA-201712-5] chromium: multiple issues
Arch Linux Security Advisory ASA-201712-5 ========================================= Severity: Critical Date : 2017-12-07 CVE-ID : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418...
Access Restriction Bypass
Wordpress is vulnerable to access restriction bypass. The newbloguser key is a string value which is derived from a userID. Attackers can bypass access restrictions by entering this string...
Updated perl-Catalyst-Plugin-Static-Simple package fixes security vulnerability
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character CVE-2017-16248...
Princeton PTW-WMS1 Access Restriction Vulnerability
The Princeton PTW-WMS1 is a wireless storage device from Princeton Japan. An access restriction vulnerability exists in the Princeton PTW-WMS1 using firmware version 2.000.012. A remote attacker could use this vulnerability to bypass the access restriction and obtain or delete data on the disk...
PT-2017-14691 · Automattic · Woocommerce
Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions 3.x Description: The issue concerns a Directory Traversal vulnerability via the /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which could potentially access a parent directory. However, a software...
[ASA-201711-30] powerdns: access restriction bypass
Arch Linux Security Advisory ASA-201711-30 ========================================== Severity: Low Date : 2017-11-27 CVE-ID : CVE-2017-15091 Package : powerdns Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-519 Summary ======= The package powerdns before...
PT-2017-14623 · Taylor Otwell · Laravel
Name of the Vulnerable Software and Affected Versions: Laravel framework versions prior to 5.5.22 Description: The issue allows remote attackers to obtain sensitive information, such as externally usable passwords, via a direct request for the /.env URI. This is due to the...
[ASA-201711-23] firefox: multiple issues
Arch Linux Security Advisory ASA-201711-23 ========================================== Severity: Critical Date : 2017-11-15 CVE-ID : CVE-2017-7826 CVE-2017-7827 CVE-2017-7828 CVE-2017-7830 CVE-2017-7831 CVE-2017-7832 CVE-2017-7833 CVE-2017-7834 CVE-2017-7835 CVE-2017-7836 CVE-2017-7837 CVE-2017-78...
Authorization Bypass
bolt is vulnerable to authorization bypasses. The attack is possible because the library does not restrict access requests to profiler routes, allowing an attacker access to sensitive information...
