1945 matches found
CVE-2018-17950
Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2...
CVE-2018-2494
Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform...
MGASA-2018-0414 Updated blueman packages fix security vulnerability
Flawed polkit authorization checks in blueman allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication boo1083066...
CVE-2018-12369
WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser permissions. This vulnerability affects Firefox ESR 60.1 and Firefox 61...
CVE-2018-0459
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who ...
Authorization
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who ...
CVE-2018-0459 Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who ...
CVE-2017-5658
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...
Authorization
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...
CVE-2017-5658
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...
SAP HCM Fiori People Profile GBX01 HR Privilege Vulnerability
SAP HCM Fiori People Profile GBX01 HR is a human resource management solution from SAP. An elevation of privilege vulnerability exists in SAP HCM Fiori People Profile GBX01 HR version 6.0, which can be exploited by an attacker to gain privileges due to a failure of the program to perform...
CVE-2018-2455
SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 in business function EAFSBCABUSOPRSEPA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...
CVE-2018-2454
SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 in business function EAFSBCABUSOPR2 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...
CVE-2018-2454
CVE-2018-2454 affects SAP Enterprise Financial Services versions 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0 in the function EAFS_BCA_BUSOPR_2 . The issue arises from missing authorization checks for an authenticated user, enabling an escalation of privileges. NVD reports CVSSv3.0 base score 8.8 (HIGH) ...
USN-3744-1 postgresql-10, postgresql-9.3, postgresql-9.5 vulnerabilities
Andrew Krasichkov discovered that the PostgreSQL client library incorrectly reset its internal state between connections. A remote attacker could possibly use this issue to bypass certain client-side connection security features. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...
CVE-2017-17707
Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely...
CVE-2017-17708
Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3...
CVE-2017-17707
The vulnerability CVE-2017-17707 affects Pleasant Password Server prior to version 7.8.3. Due to missing authorization checks, any authenticated user can list, upload, or delete attachments to password safe entries if they know the corresponding CredentialId (a GUID). Exposure can occur when an e...
CVE-2017-17707
Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely...