7227 matches found
PT-2011-2031 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A remote code execution issue exists due to improper parsing of specially crafted OpenType fonts by the OpenType Font OTF driver. This allows attackers to execute arbitrary co...
Design/Logic Flaw
The Node Quick Find module 6.x-1.1 for Drupal does not use dbrewritesql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature...
CVE-2008-7279
The CustomerInterface component in Open Ticket Request System OTRS before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors...
CVE-2009-5056
Removed by vendor...
CVE-2008-7283
Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...
SugarCRM 6.1.1 - Information Disclosure
SugarCRM 6.1.1 - Information Disclosure source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead...
SugarCRM 6.1.1 - Information Disclosure
source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks...
CVE-2011-1312
The Administrative Console component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by mapping a 1 user or 2 gro...
Access Restriction Bypass
Overview Affected versions of this package are vulnerable to Access Restriction Bypass. The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an...
CVE-2011-1123
CVE-2011-1123 affects Google Chrome prior to 9.0.597.107, where access to internal extension functions is not properly restricted. The impact is unspecified, with remote attack vectors mentioned in the description. The provided connected documents corroborate the vulnerability presence across mul...
Directory traversal
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...
CVE-2011-1008
ScripsOverlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information,...
Design/Logic Flaw
ScripsOverlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information,...
CVE-2011-1008
The CVE-2011-1008 entry concerns Best Practical Solutions’ Request Tracker (RT) prior to 3.8.9. A vulnerability in Scrips_Overlay.pm allows remote authenticated users to access sensitive information from a TicketObj after a CurrentUser change, with evidence of exposure via custom-field data tied ...
CVE-2011-1020
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...
CVE-2011-0449
The CVE-2011-0449 vulnerability affects Ruby on Rails 3.0.x (before 3.0.4). It arises in actionpack’s template resolver logic on case-insensitive filesystems, where filters for the list of available templates are not properly enforced, allowing an attacker to bypass access restrictions by using a...
RHEL 6 : subversion (RHSA-2011:0258)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0258 advisory. - Subversion: Access restriction bypass by checkout of the root of the repository CVE-2010-3315 - Subversion moddavsvn: DoS crash by...
CVE-2011-1032
IBM Lotus Connections 3.0, when IBM WebSphere Application Server 7.0.0.11 is used, does not properly restrict access to the internal login module, which has unspecified impact and attack vectors...
Apache Tomcat 6.0.x < 6.0.30 Multiple Vulnerabilities
According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.30. It is, therefore, affected by multiple vulnerabilities : - An error in the access restriction on a 'ServletContext' attribute that holds the location of the work...