CVE-2008-0896

BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended access restrictions...

CVE-2008-0898: Undefined Security Weakness

The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected...

CVE-2008-0897: Undefined Security Weakness

Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptio...

CVE-2008-0896: Undefined Security Weakness

BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended access restrictions...

CVE-2008-0037

Summary of CVE-2008-0037 : In Mac OS X up to 10.5.1, the X11 server does not correctly honor the "Allow connections from network client" preference when disabled, potentially allowing remote attackers to connect to the X server despite intended access restrictions. This vulnerability enables remo...

Mozilla Firefox 2.0.9 - view-source: Scheme Information Disclosure

Mozilla Firefox 2.0.9 - view-source: Scheme Information Disclosure source: https://www.securityfocus.com/bid/27700/info Mozilla Firefox is prone to an information-disclosure vulnerability because it fails to restrict access to local resources. Attackers can exploit this issue to obtain potentiall...

CVE-2008-0604: Undefined Security Weakness

The LDAP authentication feature in XLight FTP Server before 2.83, when used with some unspecified LDAP servers, does not check for blank passwords, which allows remote attackers to bypass intended access restrictions...

GE Fanuc Proficy Information Portal transmits authentication credentials in plain text

Overview GE Fanuc Proficy Information Portal can transmit authentication credentials in plain text. An attacker could monitor traffic, obtain valid credentials, and gain access to the portal. Description GE Fanuc Proficy Information Portal is a web-based systems reporting tool often used to...

GE Fanuc Proficy Information Portal allows arbitrary file upload and execution

Overview GE Fanuc Proficy Information Portal allows authenticated users to upload arbitrary files. An attacker could upload an executable server-side script e.g., an .asp shell on a Microsoft Internet Information Server platform and execute arbitrary commands with the privileges of the web server...

GE Fanuc CIMPLICITY HMI heap buffer overflow

Overview GE Fanuc CIMPLICITY HMI contains a remotely accessible heap buffer overflow vulnerability which may allow a remote attacker to execute arbitrary code. Description GE Fanuc CIMPLICITY HMI is software used for monitoring and control in Supervisory Control And Data Acquisition SCADA systems...

CVE-2008-0402: Undefined Security Weakness

Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated users to bypass intended access restrictions and delete unspecified repository resources via unknown vectors, even when they are not administrators or members o...

Code injection

LulieBlog 1.0.1 and 1.0.2 does not restrict access to 1 articlesuppr.php, 2 commentaccepter.php, and 3 commentrefuser.php in Admin/, which allows remote attackers to accept comments, delete comments, and delete articles via the id parameter...

CVE-2008-0329

LulieBlog 1.0.1 and 1.0.2 does not restrict access to 1 articlesuppr.php, 2 commentaccepter.php, and 3 commentrefuser.php in Admin/, which allows remote attackers to accept comments, delete comments, and delete articles via the id parameter...

IBM Director fails to properly time-out connection requests from clients

Overview IBM Director Systems, specifically CIM Server, contains a denial-of-service vulnerability that can allow a remote, unauthenticated attacker to render Director inoperative. Description IBM Director is a suite of system management tools.When a rogue connection request is made to IBM Direct...

CVE-2007-4704: Undefined Security Weakness

The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes are restarted, which might allow attackers to bypass intended access restrictions...

CVE-2007-4703: Undefined Security Weakness

The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incoming connections" has been set for its associated executable, which might allow remote attackers or local root processes to bypass intended access restrictions...

CVE-2007-4702: Undefined Security Weakness

The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions...

CVE-2007-4699: Undefined Security Weakness

The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions...

CVE-2007-5597

CVE-2007-5597 affects Drupal core: hook_comments in Drupal 4.7.x (before 4.7.8) and 5.x (before 5.3) does not pass the publication status of comments. This can allow attackers to bypass access restrictions and cause modules (e.g., Organic groups, Subscriptions) to mail or process unpublished comm...

Design/Logic Flaw

The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element...