CVE-2021-21473

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRMRFCSUBMITREPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver AB...

CVE-2021-1235

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an...

CVE-2021-21468

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table...

CVE-2021-21467

SAP Banking Services Generic Market Data does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data GMD, due to improper authorization check...

CVE-2020-16260

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation...

Authorization

trytond 2.4: ModelView.button fails to validate authorization...

CVE-2012-2238

trytond 2.4: ModelView.button fails to validate authorization...

CVE-2018-2484

SAP Enterprise Financial Services fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.6320 does not perform necessary authorization checks for an authenticated user, resulting in escalation of...

CVE-2018-7079

Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privileg...

PT-2018-17894

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions prior to 6.7.6 Aruba ClearPass Policy Manager versions prior to 6.6.10-hotfix Description The issue concerns a guest authorization failure in Aruba ClearPass Policy Manager. Certain administrative...

ceph: ceph-mon does not perform authorization on OSD pool ops

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete and corrupt snapshot images...

CVE-2018-0336

A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could...

OpenDaylight Helium Information Disclosure Vulnerability

Opendaylight, a project of the Linux Foundation, is a community-driven, open-source, software-defined networking framework that includes a collection of modules to perform networking tasks that need to be done quickly.OpenDaylight Helium is a version of it. A security vulnerability exists in the...

Vaultize Enterprise File Sharing Information Disclosure Vulnerability

Vaultize Enterprise File Sharing is an enterprise file sharing solution from Vaultize Technologies, USA. The solution includes features such as data retention management, versioning, secure data handling, data backup and recovery. A security vulnerability exists in Vaultize Enterprise File Sharin...

heinekingmedia StashCat for Android, Web and Desktop Denial of Service Vulnerability

heinekingmedia StashCat for Android, Web and Desktop are all products of the German company heinekingmedia. heinekingmedia StashCat for Android is an Android-based enterprise communication software. heinekingmedia StashCat for Web is the Web-based version and heinekingmedia StashCat for Desktop i...

PT-2014-5237

Name of the Vulnerable Software and Affected Versions Cisco Transport Gateway for Smart Call Home version 4.0 Description The issue concerns the web framework in the Cisco Transport Gateway for Smart Call Home, which fails to properly check authorization for administrative web pages. This allows...

WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

DEBIAN-CVE-2012-4542

block/scsiioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SGIO ioctl call that leverages overlapping opcodes...