Oracle Linux 8 : ol-automation-manager (ELSA-2022-9341)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9341 advisory. 1.0.2-1.el8 - Fix multiple CVEs : CVE-2017-18342, CVE-2020-10109, CVE-2020-10108, CVE-2021-33203, CVE-2021-33571, CVE-2021-44420, CVE-2021-31542,...

CVE-2021-25094

The Tatsu WordPress plugin before 3.3.12 addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress’s upload directory. By adding a PHP shell with a filename starting with a dot “.”, this can bypass extension control...

EulerOS 2.0 SP10 : keepalived (EulerOS-SA-2022-1474)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

EulerOS 2.0 SP10 : keepalived (EulerOS-SA-2022-1465)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

EulerOS Virtualization 2.10.0 : keepalived (EulerOS-SA-2022-1401)

According to the versions of the keepalived package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to...

EulerOS Virtualization 2.10.1 : keepalived (EulerOS-SA-2022-1375)

According to the versions of the keepalived package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to...

PT-2022-19401

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Access Manager Plus versions prior to 4302 Zoho ManageEngine Password Manager Pro versions prior to 12007 ManageEngine Privileged Access Manager 360 PAM360 versions prior to 5401 Description The software solutions Zoho...

Access Control Bypass

github.com/beego/beego is vulnerable to access control bypass. The vulnerability exists because matching router to runObject & parameters in tree.go is not handled properly during route lookup process...

Access control bypass in Beego

An issue was discovered in the route lookup process in beego through 2.0.1, allows attackers to bypass access control...

CVE-2021-30080

Beego contains a route lookup bypass vulnerability (CVE-2021-30080) that lets an attacker bypass access control via the route resolution path. The primary description across sources indicates the issue affects beego prior to version 1.12.11; Red Hat and OSV entries extend visibility to Beego v2 u...

Beego 安全漏洞

Beego is an open source web framework based on the Go language. A security vulnerability existed prior to Beego 2.0.1 that stemmed from a route lookup process that allowed an attacker to bypass access control...

Huawei EulerOS: Security Advisory for keepalived (EulerOS-SA-2022-1351)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : keepalived (EulerOS-SA-2022-1351)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

CVE-2021-3814

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure...

CVE-2022-22394

The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By signing in, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrator or node access to the...

CVE-2022-23730

The public API error causes for the attacker to be able to bypass API access control...

EulerOS 2.0 SP9 : keepalived (EulerOS-SA-2022-1307)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

EulerOS 2.0 SP9 : keepalived (EulerOS-SA-2022-1291)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

Access-Control Bypass

lemonldap is vulnerable to access control bypass. The vulnerability exists due to the RESTServer pwdConfirm always returns true with Combination + Kerberos...

PT-2022-3649 · Unknown +5 · 389-Ds-Base +5

Name of the Vulnerable Software and Affected Versions: 389-ds-base affected versions not specified Description: The issue is related to an access control bypass vulnerability. It involves the mishandling of a filter that yields incorrect results, allowing any remote unauthenticated user to issue ...