WordPress Trashed Posts Information Disclosure Vulnerability

WordPress is prone to an information disclosure vulnerability because it fails to properly restrict access to trashed posts. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Oracle WebLogic Server Node Manager 'beasvc.exe' Remote Command Execution Vulnerability

Oracle WebLogic Server is prone to a remote command-execution vulnerability because the software fails to restrict access to sensitive commands. Successful attacks can compromise the affected software and possibly the computer. Oracle WebLogic Server 10.3.2 is vulnerable; other versions may also ...

Oracle 10g - Multiple Privilege Escalation Vulnerabilities

Oracle 10g - Multiple Privilege Escalation Vulnerabilities source: https://www.securityfocus.com/bid/38115/info Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages. The attacker can exploit these issues to escala...

Design/Logic Flaw

Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to...

CVE-2010-0555

CVE-2010-0555 affects Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8. The root cause is URLMON sniffing that allows rendering of non-HTML local files as HTML documents after a redirect, bypassing access restrictions and enabling read of arbitrary files. The description identifies this a...

DSA-1985-1 sendmail - insufficient input validation

Bulletin has no description...

CVE-2010-0005

query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query...

CVE-2010-0005: Undefined Security Weakness

query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query...

CVE-2010-0380: Undefined Security Weakness

install.php in JCE-Tech PHP Calendars, downloaded 20100121, allows remote attackers to bypass intended access restrictions and modify application settings via a direct request. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation...

Rockwell Automation Allen-Bradley MicroLogix PLC authentication and authorization vulnerabilities

Overview Rockwell Automation Allen-Bradley MicroLogix programmable logic controllers PLCs do not adequately authenticate or authorize remote connections or commands. An attacker with network access can obtain the management password or issue commands that bypass the authentication mechanism...

CVE-2010-0007

CVE-2010-0007 affects the Linux kernel’s ebtables in netfilter, where netfilter/ebtables.c allows local users to modify rules without CAP_NET_ADMIN, bypassing access restrictions and enabling arbitrary network-traffic filtering via a modified ebtables user-space tool. Vulnerable: kernel before 2....

CVE-2010-0014

System Security Services Daemon SSSD before 1.0.1, when the krb5 authprovider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting...

JVN#09872874 Movable Type access restriction bypass vulnerability

Movable Type, a web log system from Six Apart KK, contains a vulnerability that allows a remote attacker to bypass access restrictions. This vulnerability is different from JVN08369659. Impact A remote attacker may view or modify information stored by Movable Type. Solution Update the Software...

CVE-2009-4565: Undefined Security Weakness

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name CN field of an X.509 certificate, which 1 allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and 2 allows...

CVE-2009-4520: Undefined Security Weakness

The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path...

CVE-2009-4455: Undefined Security Weakness

The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance Cisco ASA 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restrictions and access unauthorized web site...

MySQL CREATE TABLE调用绕过访问限制漏洞

CVE ID: CVE-2008-7247 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 当数据主目录包含有到不同文件系统的符号链接时，MySQL的ql/sqltable.cc允许通过认证的远程攻击者通过以特殊DATA DIRECTORY或INDEX DIRECTORY参数调用CREATE TABLE绕过预期的访问限制，执行各种非授权操作。 MySQL AB MySQL 6.0 MySQL AB MySQL 5.1.x MySQL AB MySQL 5.0.x 厂商补丁： MySQL AB --------...

Design/Logic Flaw

sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a 1 DATA DIRECTORY or 2...

Deserialization of untrusted data

comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete comments via the 1 edit or 2 del action...

CVE-2009-4091

The CVE-2009-4091 entry affects Simplog 0.9.3.2 (and potentially earlier) in comments.php where access restrictions are insufficient. This permits remote attackers to edit or delete comments via the (1) edit or (2) del actions. The NVD entry assigns a CVSS v2 base score of 5.0 (Medium) with netwo...