Key Systems Electronic Key Lockers command injection and weak authentication vulnerabilities

OVERVIEW Key Systems Electronic Key Lockers contain a command injection vulnerability which may allow a remote unauthenticated attacker to inject commands into the electronic key locker. Key Systems Electronic Key Lockers also contains weak authentication which could allow an attacker...

CVE-2012-3991

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have...

CVE-2010-5277: Undefined Security Weakness

Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users user 0 via unspecified vectors...

CVE-2012-1623

The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions...

CVE-2012-1623

Affected software: Drupal with the Registration Codes contributed module (6.x) prior to 6.x-2.4. Vulnerability: The module does not restrict access to the registration code list, potentially allowing unauthorized users to view codes and bypass registration restrictions. Root cause: Insufficient a...

Code injection

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...

CVE-2012-2153

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...

CVE-2012-1833

The CVE-2012-1833 entry affects VMware SpringSource Grails before 1.3.8 and Grails 2.x before 2.0.2. The root cause is improper data binding restrictions, which could allow remote attackers to bypass access controls and modify arbitrary object properties through a crafted request parameter. No ex...

Information disclosure

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

CVE-2012-2680

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

PT-2012-4643

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 6.1 before 6.1.0.45 IBM WebSphere Application Server WAS versions 7.0 before 7.0.0.25 IBM WebSphere Application Server WAS versions 8.0 before 8.0.0.5 IBM WebSphere Application Server WAS versions...

CVE-2012-3311: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users ...

CVE-2012-3743

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files...

CVE-2012-3738

CVE-2012-3738 affects Apple iOS before 6, in the Passcode Lock Emergency Dialer. A logic issue allowed a physically proximate user to bypass access restrictions and initiate FaceTime calls via Voice Dialing, potentially exposing contact information. The issue is tied to the Emergency Dialer scree...

CVE-2012-4993

torrentfunctions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact...

CVE-2012-4993

torrentfunctions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact...

Design/Logic Flaw

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation...

CVE-2012-4408

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation...

PT-2012-5381

Name of the Vulnerable Software and Affected Versions Moodle versions 2.1.x through 2.1.7 Moodle versions 2.2.x through 2.2.4 Moodle versions 2.3.x through 2.3.1 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the course/reset.php fil...

CoSoSys Endpoint Protector 4 appliance contains a predictable password for root-equivalent account vulnerability

Overview CoSoSys Endpoint Protector 4 appliance contains a predictable password for root-equivalent accounts. Description According to the CoSoSys's website the Endpoint Protector 4 appliance is a DLP product used to prevent users from taking unauthorized data outside the company or bringing...