CVE-2019-14071

Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect secure or non-secure ram dumps in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

Denial of Service Vulnerability in H3C S5120V2-SI Series Switches

H3C S5120V2-SI switch is a Layer 2 Gigabit Ethernet switch independently developed by Xinhua San Technologies Co., Ltd hereinafter referred to as H3C, which is a second-generation intelligent managed switch designed for network environments requiring high performance, high port density, and easy...

Information disclosure

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

CVE-2019-17426

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

CVE-2016-10830

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magicrevision SEC-100...

CVE-2019-0217

A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. Mitigation This flaw only affects a threaded server...

Cisco IOS XE Software Access Control Error Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. An access control error vulnerability exists in the MACsec Key Agreement MKA using Extensible Authentication Protocol-Transport Layer Security EAP-TLS functionality in Cisco IOS XE Software, which arises from...

CVE-2017-15044

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

The vulnerability of Qualcomm’s TrustZone microprogramming software technology, which allows attackers to circumvent existing access control policies.

The vulnerability of Qualcomm’s TrustZone microprogramming software lies in a numerical overflow condition that causes an operation to escape outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to bypass existing access control policies...

The vulnerability of the Android operating system, which allows a hacker to bypass security measures and delete data

The vulnerability of Google Play’s Android operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating locally, to bypass security measures and delete data...

The vulnerability of the Firefox ESR browser allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability of the Firefox ESR browser allows a malicious actor to bypass access control policies and execute arbitrary JavaScript code with Chrome privileges, using frame relays...

The vulnerability of Microsoft Edge browser allows a hacker to bypass existing access restrictions policies.

The vulnerability of Microsoft Edge is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing access control policies...

Cisco ACE 4710 Application Control Engine Command Injection Vulnerability

Cisco ACE 4710 Application Control Engine is the United States Cisco Cisco a set of ACE application switch series and used to increase the security and stability of data center applications load balancing and application delivery solutions. A command injection vulnerability exists in the Cisco AC...

flash-plugin: multiple code execution issues fixed in APSB15-32

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to bypass intended access restrictions via...

The vulnerability of Firefox and Firefox ESR browsers allows attackers to circumvent access control policies.

The vulnerability of Firefox and Firefox ESR browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access control policies using the JSON.parse method...

USN-2663-1 linux vulnerabilities

Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes xattrs. A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges. CVE-2014-9710 A race condition was discovered in the Linux kernel's filehandle size...

nss: CERT_VerifyCert returns SECSuccess (saying certificate is good) even for bad certificates (MFSA 2013-103)

The CERTVerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services NSS 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access...