CVE-2019-3399

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...

CVE-2019-3399: Incorrect Authorization

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...

PT-2019-16556

Name of the Vulnerable Software and Affected Versions Jira versions prior to 7.13.2 Jira versions 8.0.0 through 8.0.1 Description The issue allows remote attackers to see information for archived projects due to a missing authorization check in the BrowseProjects.jspa resource. Recommendations Fo...

Information disclosure in the BrowseProjects.jspa resource - CVE-2019-3399

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...

Information disclosure in the /rest/api/2/user/picker rest resource - CVE-2019-3403

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check...

Permissions bypass in the inline-create rest resource - CVE-2018-20826

The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check...

CVE-2019-9974

diagtool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET request to enumerate LAN devices or crash the router with a DoS attack...

PT-2019-19969

Name of the Vulnerable Software and Affected Versions DASAN H660RM GPON routers with firmware 1.03-0022 Description The issue concerns a lack of authorization check in the diag tool.cgi component, allowing remote attackers to send a GET request and execute a ping command. This can be used to...

openSUSE Security Update : postgresql10 (openSUSE-2019-659)

This update for postgresql10 fixes the following issues : PostgreSQL 10 was updated to 10.5 : - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-10-5.html A dump/restore is not required for those running 10.X. However, if you use the adminpack...

Authorization

Banking services from SAP 9.0 FSAPPL version 5 and SAP S/4HANA Financial Products Subledger S4FPSL, version 1 performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges...

CVE-2019-0276

Banking services from SAP 9.0 FSAPPL version 5 and SAP S/4HANA Financial Products Subledger S4FPSL, version 1 performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges...

CVE-2019-0276

CVE-2019-0276 affects SAP Banking services from SAP 9.0 (FSAPPL v5) and SAP S/4HANA Financial Products Subledger (S4FPSL v1). Description indicates an inadequate authorization check for an authenticated user, potentially enabling escalation of privileges. No precise exploit details, affected comp...

CVE-2019-0276

Banking services from SAP 9.0 FSAPPL version 5 and SAP S/4HANA Financial Products Subledger S4FPSL, version 1 performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges...

CVE-2019-1604 Cisco NX-OS Software Privilege Escalation Vulnerability

A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check of user accounts and their associated Group ID GID. An...

SAP BW/4HANA Remote Authorization Bypass Vulnerability

SAP BW/4HANA is a data warehouse solution based on SAP HANA from SAP, Germany. The product is able to integrate with SAP or non-SAP applications for real-time data processing. A remote authorization bypass vulnerability exists in SAP BW/4HANA version 1.0 SP08, which stems from the maintenance of...

SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2018:2564-1)

This update for postgresql10 fixes the following issues : PostgreSQL 10 was updated to 10.5 : https://www.postgresql.org/about/news/1851/ https://www.postgresql.org/docs/current/static/release-10-5.html A dump/restore is not required for those running 10.X. However, if you use the adminpack...

Micro Focus NetIQ eDirectory Authorization Check Error Vulnerability

Micro Focus NetIQ eDirectory is an identity management infrastructure platform from Micro Focus UK that combines identity management architecture and directory services technology. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. An...

PT-2018-14295

Name of the Vulnerable Software and Affected Versions eDirectory versions prior to 9.1 SP2 Description The issue is related to incorrect enforcement of authorization checks. Recommendations For versions prior to 9.1 SP2, update to version 9.1 SP2 or later to resolve the issue...

HackerOne: Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report

Hi Hackerone team, I am still able to access other program details etc. when i'm authenticated to HackerOne through SAML . I'm not sure if it's the same bug i reported earlier or there is some weak authorization check in place. PFA for more info i can access related to ██████████ etc. See the dat...

CVE-2018-19110

The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization chec...