CVE-2013-4311

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

CVE-2013-4326

MiracleLinux 4 advisories reference CVE-2013-4326 in rtkit-0.5-2.AXS4, describing a Polkit-related race condition that allows local bypass of access restrictions via PolkitUnixProcess with setuid or pkexec. The linked Nessus notes (AXSA:2013-629:01) and (AXSA:2013-630:01) indicate affected packag...

CVE-2013-3688

The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to 1 cause a denial of service device reboot via a request to...

CVE-2013-2269

The CVE-2013-2269 entry describes a logic flaw in Aruba Networks ClearPass (5.x, 6.0.1, 6.0.2) and Amigopod/ClearPass Guest (3.0–3.9.7) where an attacker can bypass access controls by initiating a guest request, then using parameter manipulation and information from a default holding page to loca...

CVE-2013-4294

OpenStack Keystone (Identity) on Folsom 2012.2.x and Grizzly up to 2013.1.3/pre-2013.1.4 is affected where the memcache and KVS token back ends do not properly compare the PKI token revocation list with PKI tokens, allowing revoked tokens to bypass access controls. Red Hat advisory RHSA-2013:1285...

CVE-2013-4325

CVE-2013-4325 affects HP Linux Printing and Imaging (HPLIP) up to version 3.13.9, where a Polkit race between PolkitUnixProcess and a polkit authority can allow a local user to bypass access restrictions via a setuid process or pkexec. Related advisories/bulletins indicate the fix requires upgrad...

Dell iDRAC 6 and iDRAC 7 are vulnerable to a cross-site scripting (XSS) attack

Overview Dell iDRAC 6 version 1.41, Dell iDRAC 7 version 1.40.40 and possibly earlier versions contain a reflected cross-site scripting XSS CWE-79 vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Dell iDRAC 6 version 1.41 and De...

OTRS < 2.3.0-beta4 Merge Operations Restriction Bypass Vulnerability

Open Ticket Request System OTRS is prone to a restriction bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

OTRS < 2.4.4 Ticket CustomerID Value Restriction Bypass Vulnerability

Open Ticket Request System OTRS is prone to a restriction bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Thunderbird ESR 17.x < 17.0.9 Multiple Vulnerabilities

The installed version of Thunderbird ESR 17.x is earlier than 17.0.9 and is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. CVE-2013-1718, CVE-2013-1719 - Multiple...

Firefox ESR 17.x < 17.0.9 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox ESR 17.x is earlier than 17.0.9 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-1718, CVE-2013-1719 - Multiple...

CVE-2013-1064

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

CVE-2013-4311

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

Cisco Network Admission Control Guest Server System Software Authentication Bypass (cisco-sa-20110330-nac)

The remote Cisco Network Admission Control NAC Manager may be affected by an access restriction bypass vulnerability in the RADIUS authentication software. This vulnerability could allow a remote/unauthenticated attacker access to a protected network. C Tenable Network Security, Inc...

CVE-2013-4182

app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...

CVE-2013-4182

app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...

CVE-2013-2934

Citrix CloudPortal Services Manager aka Cortex 10.0 before Cumulative Update 3 does not properly restrict access to web services, which has unspecified impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162...

CVE-2013-2123

The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author's user account is deleted, which allows remote attacke...

CVE-2013-2247

The Drupal vulnerability CVE-2013-2247 affects the Fast Permissions Administration module (Drupal 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.3). The issue is that access to the modal content callback is not properly restricted, allowing remote attackers to obtain unspecified access to the pe...