7227 matches found
CVE-2008-6701
NetScout formerly Network General Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/enUS/domains/adddomain.jsp, which allows remote attackers to gain administrator privileges via a direct request...
CVE-2008-6701
NetScout Visualizer V2100 and InfiniStream i1730 expose a direct access path to ResourceManager/en_US/domains/add_domain.jsp, allowing remote attackers to obtain administrator privileges. The issue arises from lack of access restriction on this resource, enabling privilege escalation via a direct...
CVE-2008-6673
asp/bslogin.asp in QuickerSite 1.8.5 does not properly restrict access to administrative functionality, which allows remote attackers to 1 change the admin password via the cSaveAdminPW action; 2 modify site information, such as the contact address, via the saveAdmin; and 3 modify the site design...
CVE-2008-6673
CVE-2008-6673 affects QuickerSite 1.8.5. The issue is an improper access restriction on admin functionality, allowing remote attackers to perform admin actions via unauthenticated requests: (1) change the admin password through cSaveAdminPW, (2) modify site information such as the contact address...
CVE-2008-6613
CVE-2008-6613 affects minimal-ablog 0.4, where uploader.php fails to properly restrict access. This allows remote attackers to gain administrative privileges via a direct request. The description and linked references confirm the component and impact but do not provide exploit details, affected v...
CVE-2008-6613
uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request...
CVE-2009-1226
CVE-2009-1226 affects Podcast Generator 1.1 and earlier. The issue is an improper restriction of access to admin functions in core/admin/delete.php, allowing remote attackers to delete arbitrary files via the file parameter. Base score 7.5 (HIGH) per NVD. No patch/mitigation details are provided ...
CVE-2009-1084
Sun Java System Identity Manager IdM 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object...
CVE-2009-1084
Sun Java System Identity Manager IdM 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object...
CVE-2009-1084
Sun Java System Identity Manager (IdM) versions 7.0–8.0 are affected by an access-control weakness in the System Configuration object that allows remote authenticated administrators, and possibly remote attackers, to modify the object with an unspecified impact. The root cause is improper restric...
JIRA build information not included in dummy XML responses to search filter requests which users do not have access to
The build-info element is missing from the response to search filter XML requests. noformat https://support.atlassian.com/sr/jira.issueviews:searchrequest-xml/10593/SearchRequest-10593.xml?tempMax=100 noformat Happens if the user does not have access to the filter. See also...
GLSA-200903-06 : nfs-utils: Access restriction bypass
The remote host is affected by the vulnerability described in GLSA-200903-06 nfs-utils: Access restriction bypass Michele Marcionelli reported that nfs-utils invokes the hostsctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups. Impact : A remote attacker...
nfs-utils: Access restriction bypass
Background nfs-utils contains the client and daemon implementations for the NFS protocol. Description Michele Marcionelli reported that nfs-utils invokes the hostsctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups. Impact A remote attacker could bypass...
[SECURITY] [DSA 1725-1] New websvn packages fix information leak
------------------------------------------------------------------------ Debian Security Advisory DSA-1725-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst February 15, 2009 http://www.debian.org/security/faq -...
DSA-1725-1 websvn - information leak
Bulletin has no description...
Design/Logic Flaw
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly...
CVE-2009-0411
Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script...
CVE-2009-0411
CVE-2009-0411 affects Google Chrome prior to 1.0.154.46, where web pages could access the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers via XMLHttpRequest and other web scripts, leading to potential disclosure of cookie data. Root cause: insufficient restriction of cross-origin access ...