DEBIAN-CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

RANGER Studio Directus License Issue Vulnerability

RANGER Studio Directus is a set of open source headless CMS and API for managing custom databases from RANGER Studio, U.S.A. The Directus API is one of the components that can add a RESTful API layer to new or existing SQL databases. An authorization issue vulnerability exists in the Directus 7...

Huawei PC Manager Authorization Issues Vulnerability

Huawei PC Manager is a computer management application from Huawei China. An authorization issue vulnerability exists in Huawei PC Manager version 9.1.3.1, which arises from the driver's interface not adequately validating data from the userland. An attacker could exploit the vulnerability to...

CVE-2019-3734

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users...

Cloud Foundry UAA Authorization Issues Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry Cloud Platform. An authorization issue vulnerability exists in Cloud Foundry UAA versions prior to v70.0. An attacker could exploit this vulnerability to impersonate another user by changing their address to...

GitLab EE Authorization Issues Vulnerability (CNVD-2019-42743)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab EE...

CVE-2018-19569

GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization flaw that lets a user access the web UI using a Personal Access Token of any scope. The root cause is an authorization issue that improperly permits PAT-authenticat...

CVE-2019-5981

Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with administrative privilege via unspecified vectors...

Multiple ZOHO Products License Issue Vulnerabilities

ZOHO ManageEngine Desktop Central DC and so on are the products of the United States ZhuoHao ZOHO company.ManageEngine Desktop Central is a set of desktop management solutions.ZOHO ManageEngine ServiceDesk Plus is a set of ITIL architecture based on IT service management software ITSM.ZOHO...

Cisco IOS XR Authorization Issues Vulnerability

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR is vulnerable to an authorization issue. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a network system or...

GitLab Authorization Issues Vulnerability (CNVD-2019-43039)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab. Th...

Authorization

ABAP BASIS function modules INSTCREATER3RFCDEST, INSTCREATETCPIPRFCDEST, and INSTCREATETCPIPRFCDEST in SAP BASIS fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53 do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in...

IBM InfoSphere Information Server Authorization Issues Vulnerability

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. An authorization issue vulnerability exists in IBM InfoSphere Information Server. The vulnerability arises...

CVE-2019-10040

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

Authorization

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability tha...

CVE-2018-1000418

CVE-2018-1000418 affects Jenkins HipChat Plugin (versions ≤ 2.2.0). The HipChatNotifier.java improper authorization allows users with Overall/Read access to trigger test notifications to an attacker-controlled HipChat server using attacker-specified credential IDs, enabling capture of credentials...

Amazon Linux AMI : postgresql95 (ALAS-2018-1118)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

Authorization

The Dell OpenManage Network Manager virtual appliance versions prior to 6.5.3 contain an improper authorization vulnerability caused by a misconfiguration in the /etc/sudoers file...

Authorization

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials...

CVE-2018-7363

ZTE ZXHN F670 devices with firmware versions up to 1.1.10P3T18 are affected by an improper authorization vulnerability. The appviahttp service has no authorization delay, allowing brute‑force credential attempts. Connected records confirm affected versions and brute‑force risk; no exploit details...