CVE-2012-0030

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified projectid URI parameter...

PT-2012-2253

Name of the Vulnerable Software and Affected Versions Nova versions 2011.3 and Essex Description The issue allows remote authenticated users to bypass access restrictions for tenants of other users when using the OpenStack API. This is achieved via an OSAPI request with a modified project id URI...

CVE-2012-0030: Undefined Security Weakness

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified projectid URI parameter...

CVE-2011-5057

Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an...

CVE-2011-3666: Undefined Security Weakness

Mozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar files to be executable files, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted file. NOTE: this vulnerability exists because of an incorrect fix for...

PT-2011-4573

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.25 Thunderbird versions prior to 3.1.17 Description The issue allows user-assisted remote attackers to bypass intended access restrictions via a crafted file, because .jar files are not considered executab...

PT-2011-5096 · Parallels · Parallels Plesk Small Business Panel

Name of the Vulnerable Software and Affected Versions: Parallels Plesk Small Business Panel version 10.2.0 Description: The Site Editor feature in Parallels Plesk Small Business Panel allows remote attackers to obtain ASP source code via a direct request to "wysiwyg/fckconfig.js". Note that the...

PT-2011-5025

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.3.0 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the software not properly recognizing the disabled status of a field in the Leads module, enablin...

CVE-2011-4679: Undefined Security Weakness

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

PT-2012-2041

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.11 Description The issue is related to the HTTP Digest Access Authentication implementation, which does not check real...

Ubuntu 11.10 : linux vulnerability (USN-1275-1)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. CVE-2011-1162 Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit...

Design/Logic Flaw

Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2011-3891

CVE-2011-3891 affects Google Chrome prior to 15.0.874.102, where improper restriction of internal Google V8 functions may enable remote attackers to cause a denial of service or potentially other impact via unknown vectors. The cited connected advisories indicate this requires upgrading to Chrome...

CVE-2011-3887

Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors...

CVE-2011-2677

Cybozu Office before 8.0.0 allows remote authenticated users to bypass intended access restrictions and access sensitive information time card and attendance via unspecified vectors related to manipulation of a URL...

CVE-2011-2677

Cybozu Office before 8.0.0 is affected by an improper access control vulnerability where remote authenticated users can bypass restrictions and access sensitive information (time card and attendance) by manipulating a URL. Affected product: Cybozu Office (pre-8.0.0). Root cause: insufficient enfo...

CVE-2011-2677

Cybozu Office before 8.0.0 allows remote authenticated users to bypass intended access restrictions and access sensitive information time card and attendance via unspecified vectors related to manipulation of a URL...

PT-2011-4021

Name of the Vulnerable Software and Affected Versions Cybozu Office versions prior to 8.0.0 Description The issue allows remote authenticated users to bypass intended access restrictions, accessing sensitive information such as time card and attendance data. This is achieved through manipulation ...

CVE-2011-0260

CVE-2011-0260 affects the CoreProcesses component in Mac OS X 10.7 prior to 10.7.2 . The issue allowed a window on the locked screen to receive keystrokes, potentially enabling a physically proximate attacker to bypass screen-lock restrictions. Apple addresses this by preventing system windows fr...

CVE-2011-3257: Undefined Security Weakness

The Data Access component in Apple iOS before 5 does not properly handle the existence of multiple user accounts on the same mail server, which allows local users to bypass intended access restrictions in opportunistic circumstances by leveraging a different account's cookie...