PT-2011-1275

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.6 Description The issue allows remote authenticated users to bypass intended access restrictions and perform certain list and write operations on queues. This occurs when the...

PT-2011-1317

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.0-beta2 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the improper enforcement of the move into permission setting for a...

PT-2011-1270

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.3.0-beta4 Description The issue allows remote authenticated users to potentially bypass intended access restrictions. This occurs because the system checks for the wrong permission during...

CVE-2008-7283: Undefined Security Weakness

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2008-7282: Undefined Security Weakness

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System OTRS before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain 1 list and 2...

CVE-2008-7279: Undefined Security Weakness

The CustomerInterface component in Open Ticket Request System OTRS before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors...

SugarCRM 6.1.1 - Information Disclosure

SugarCRM 6.1.1 - Information Disclosure source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead...

SugarCRM 6.1.1 - Information Disclosure

source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks...

CVE-2011-1088

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application...

PT-2011-3115

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.10 Description The issue allows remote attackers to bypass intended access restrictions via HTTP requests to a web application because it does not follow ServletSecurity annotations when web.xml has no...

CVE-2011-1419: Undefined Security Weakness

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2011-1088: Undefined Security Weakness

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application...

CVE-2011-1312

The Administrative Console component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by mapping a 1 user or 2 gro...

CVE-2011-1312: Undefined Security Weakness

The Administrative Console component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by mapping a 1 user or 2 gro...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an...

CVE-2011-1123

CVE-2011-1123 affects Google Chrome prior to 9.0.597.107, where access to internal extension functions is not properly restricted. The impact is unspecified, with remote attack vectors mentioned in the description. The provided connected documents corroborate the vulnerability presence across mul...

CVE-2011-0278: Undefined Security Weakness

Unspecified vulnerability in HP Web Jetadmin 10.2 Service Release 3 and 4 allows local users to bypass intended access restrictions via unknown vectors...

CVE-2011-1008

ScripsOverlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information,...

Directory traversal

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...

Design/Logic Flaw

ScripsOverlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information,...