CVE-2019-3850

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

CVE-2019-3850: URL Redirection to Untrusted Site

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

PT-2019-16744

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.6.3 moodle versions prior to 3.5.5 moodle versions prior to 3.4.8 moodle versions prior to 3.1.17 Description A vulnerability was found where links within assignment submission comments would open directly in the sam...

CVE-2018-15509: Incorrect Permission Assignment for Critical Resource

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control issue 2 of 2...

(0Day) (Pwn2Own) Google Android Contacts Incorrect Permission Assignment Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Google Android. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

fly-admin-autostart Pointer Assignment DoS

The vulnerability of the fly-admin-autostart utility for configuring automatic startup of programs in the Astra Linux operating system is related to the lack of checking for the value of a pointer being set to NULL. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2018-12014

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Null pointer dereference vulnerability may occur due to missing NULL assignment in NAT module of freed pointer...

CVE-2019-1000001

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role...

Design/Logic Flaw

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role...

CVE-2019-1000001

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role...

CVE-2018-18812: Incorrect Permission Assignment for Critical Resource

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when th...

Zero Trust and the Case for Application Microsegmentation

Data breaches have become incessant. Recently, a very popular airline sevices company revealed a suspected breach involving customer credit card information. Even more recently, a hospital in Indiana reported that a virus had infected some of its systems that caused the hospital to be placed on...

PT-2018-19324

Уязвимость пакета linux-astra-modules операционной системы Astra Linux связана с ошибкой назначения прав доступа, приводящей к возможности обхода замкнутой программной среды ЗПС через запись в /proc/$PID/mem. Эксплуатация уязвимости может позволить нарушителю обойти заданные правила политики...

CVE-2018-20567: Incorrect Permission Assignment for Critical Resource

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

CVE-2018-20301

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints e.g., creating, editing, updating allow users to update any coherencefields data. For example, users can automatically confirm their accounts ...

PT-2018-15301

Name of the Vulnerable Software and Affected Versions Steve Pallen Coherence versions prior to 0.5.2 Description An issue similar to a Mass Assignment vulnerability was discovered, affecting "registration" endpoints such as creating, editing, and updating. This allows users to update any coherenc...

CVE-2018-20301: Improper Input Validation

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints e.g., creating, editing, updating allow users to update any coherencefields data. For example, users can automatically confirm their accounts ...

CVE-2018-18093: Incorrect Permission Assignment for Critical Resource

Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access...

CVE-2018-14703: Incorrect Permission Assignment for Critical Resource

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

CVE-2018-15768: Incorrect Permission Assignment for Critical Resource

Dell OpenManage Network Manager versions prior to 6.5.0 enabled read/write access to the file system for MySQL users due to insecure default configuration setting for the embedded MySQL database...