Gutenberg - Critical - Access bypass - SA-CONTRIB-2021-007

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not correctly validate access rules in certain situations allowing anonymous users to delete blocks...

CVE-2020-13591

An exploitable SQL injection vulnerability exists in the "accessrules/rulesform" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done...

PT-2021-9656 · Unknown · Rukovoditel Project Management App

Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: A SQL injection vulnerability exists in the "access rules/rules form" page. This can be triggered by a specially crafted HTTP request, allowing an attacker to perform SQL injection...

CVE-2020-3578

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked...

Authorization Bypass

Overview When access rules are used inside a protected host, some URL encodings may bypass filtering system. Recommendation Upgrade to version 0.5.2. References - https://github.com/advisories/GHSA-x44x-r84w-8v67 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290...

GHSA-X44X-R84W-8V67 Lack of URL normalization may lead to authorization bypass when URL access rules are used

Impact When access rules are used inside a protected host, some URL encodings may bypass filtering system. Patches Version 0.5.2 includes a patch that fixes the vulnerability Workarounds No way for users to fix or remediate the vulnerability without upgrading References...

Lack of URL normalization may lead to authorization bypass when URL access rules are used

Impact When access rules are used inside a protected host, some URL encodings may bypass filtering system. Patches Version 0.5.2 includes a patch that fixes the vulnerability Workarounds No way for users to fix or remediate the vulnerability without upgrading References...

Debian DSA-4762-1 : lemonldap-ng - security update

It was discovered that the default configuration files for running the Lemonldap::NG Web SSO system on the Nginx web server were susceptible to authorisation bypass of URL access rules. The Debian packages do not use Nginx by default. C Tenable Network Security, Inc. The descriptive text and...

DEBIAN-CVE-2020-5275

In symfony/security-http before versions 4.4.7 and 5.0.7, when a Firewall checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take...

[SECURITY] [DLA 1791-1] lemonldap-ng security update

Package : lemonldap-ng Version : 1.9.7-3+deb9u1 CVE ID : CVE-2019-12046 Debian Bug : 928944 An attack vector was discovered by the lemonldap-ng developers. When the SAML or CAS service provider is enabled and the administrator has chosen to store the SAML/CAS tokens in the session database, an...

Android maxdsm Driver Kernel Information Disclosure Vulnerability

Exploit for Android platform in category local exploits Android: Kernel information disclosure in "maxdsmread" The "maxdsm" driver exposes several character devices which can be used to control and calibrate the device. One such device is the "control device", exposed under: "/dev/dsmctrldev". Th...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

[SECURITY] Fedora 24 Update: squidGuard-1.4-26.fc24

squidGuard can be used to - limit the web access for some users to a list of accepted/well known web servers and/or URLs only. - block access to some listed or blacklisted web servers and/or URLs for some users. - block access to URLs matching a list of regular expressions or words for some users...

[SECURITY] Fedora 22 Update: squidGuard-1.4-26.fc22

squidGuard can be used to - limit the web access for some users to a list of accepted/well known web servers and/or URLs only. - block access to some listed or blacklisted web servers and/or URLs for some users. - block access to URLs matching a list of regular expressions or words for some users...

Veris: Stored XSS in Access Rules

XSS trigger issue...

Fedora 22 : php-horde-horde-5.2.9-1.fc22 (2016-3d1183830b)

horde 5.2.9 jan SECURITY: Fix XSS vulnerability in menu bar exposed by few applications Bug 14213. jan Add more detailed user DN settings to Kolab group configuration Request 11737. jan Fix returning to last page after problem reporting from AJAX pages Bug 12112. jan Fix custom database...

USB Defense: Stop Data Walking Out The Door

The bad news is that internal data breaches are on the rise. And one of the biggest culprits? USB devices. In the past few years, there has been many organizations tracking down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media...

UBUNTU-CVE-2015-2172

DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API...

Debian DSA-2118-1 : subversion - logic flaw

Kamesh Jayachandran and C. Michael Pilat discovered that the moddavsvn module of Subversion, a version control system, is not properly enforcing access rules which are scope-limited to named repositories. If the SVNPathAuthz option is set to 'shortcircuit' set this may enable an unprivileged...

[SECURITY] [DSA 2118-1] New subversion packages fix authentication bypass

--------------------------------------------------------------------------- Debian Security Advisory DSA-2118-1 [email protected] http://www.debian.org/security/ Nico Golde October 8th, 2010 http://www.debian.org/security/faq -...