CVE-2012-0215

model/modelstorage.py in the Tryton application framework trytond before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a 1 create, 2 write, 3 delete, or 4 cop...

Code injection

model/modelstorage.py in the Tryton application framework trytond before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a 1 create, 2 write, 3 delete, or 4 cop...

CVE-2012-0215

model/modelstorage.py in the Tryton application framework trytond before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a 1 create, 2 write, 3 delete, or 4 cop...

CVE-2012-0215

CVE-2012-0215 affects the Trytond application framework prior to 2.4.0 (Python). The flaw is an improper restriction on the Many2Many field in the relation model, allowing remote authenticated users to modify privileges of arbitrary users via rpc calls: (1) create, (2) write, (3) delete, or (4) c...

CVE-2011-4303

lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registrationhubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature...

CVE-2011-4300

The filebrowser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file...

CVE-2011-4300

The CVE-2011-4300 issue affects Moodle’s file_browser in versions 2.0.0–2.0.4 and 2.1.0–2.1.1. It fails to properly restrict access to category and course data, enabling remote attackers to obtain potentially sensitive information by requesting a file. The documented remediation is to upgrade to ...

CVE-2011-4309: Undefined Security Weakness

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL...

CVE-2012-2721: Undefined Security Weakness

The default views in the Organic Groups OG module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact...

PT-2012-4219

Name of the Vulnerable Software and Affected Versions Protected Node module versions 6.x-1.x through 6.x-1.5 Description The issue allows remote attackers to bypass intended access restrictions when nodes are accessed outside of the standard node view. Recommendations For Protected Node module...

CVE-2012-2654

The 1 EC2 and 2 OS APIs in OpenStack Compute Nova Folsom 2012.2, Essex 2012.1, and Diablo 2011.3 do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restriction...

PT-2012-6313

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions 2011.3 through 2012.2 Description The issue allows remote attackers to bypass intended access restrictions due to improper protocol checking when security groups are created and the network protocol is not...

Design/Logic Flaw

The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request...

CVE-2012-2170

CVE-2012-2170 - IBM WebSphere Application Server (7.x) Affects IBM WebSphere Application Server 7.x prior to 7.0.0.23. The vulnerability stems from the Application Snoop Servlet not properly restricting access, enabling remote attackers to obtain sensitive client and request information via a dir...

CVE-2012-2692

MantisBT versions before 1.2.11 are vulnerable: when form_security_validation is OFF, delete_attachments_threshold permission is not enforced, allowing remote authenticated users with certain privileges to delete arbitrary attachments. Root cause: missing permission check in delete path. Impact: ...

PT-2012-1161 · Gentoo +4 · Gentoo Linux +4

Name of the Vulnerable Software and Affected Versions: OpenLDAP versions prior to 2.4.35 Gentoo Linux affected versions not specified Description: The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely, potentially allowing...

PT-2012-4185

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.11 Description The issue allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments due to a lack of permission check for delete attachments...

Design/Logic Flaw

fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc//io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password...

PT-2012-3753

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 10.3.183.20 and 11.x prior to 11.3.300.257 on Windows and Mac OS X Adobe Flash Player versions prior to 10.3.183.20 and 11.x prior to 11.2.202.236 on Linux Adobe Flash Player versions prior to 11.1.111.10 o...

CVE-2012-1012

server/serverstubs.c in the kadmin protocol implementation in MIT Kerberos 5 aka krb5 1.10 before 1.10.1 does not properly restrict access to 1 SETSTRING and 2 GETSTRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global...