Atlassian JIRA XSRF, Open Redirect, and Access Control Bypass Vulnerabilities

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

UBUNTU-CVE-2018-14432

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all...

GHSA-686G-3XR3-X4X6 Information Exposure on Case Insensitive File Systems in serve

Versions of serve before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems. Recommendation Update to version 7.0.0 or later...

HackerOne: Ajouter le même utilisateur que celui déjà inscrit dans les équipes

Description: Possibilité d'ajouter le même utilisateur que celui déjà inscrit dans les équipes. Steps To Reproduce 1. Aller sur https://hackerone.com/teamname/teammembers 2. Observer les emails des utilisateurs. 3. Utiliser le même email que celui précédemment inscrit, mais varier les majuscules ...

CVE-2018-12691

Time-of-check to time-of-use TOCTOU race condition in org.onosproject.acl aka the access control application in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection...

Access Control Bypass

Kentico CMS is affected by an access control bypass vulnerability. An attacker is able to access the installation wizard and initiate the installation of a new starter site which automatically grants Global Administrator access...

CVE-2018-10661

An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control...

CVE-2018-10661

An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control...

Central Web Authentication ACL Bypass Vulnerability in Multiple Cisco Devices

Cisco Aironet 1560 Series Access Points and others are different families of wireless access point devices from Cisco, Inc.Central Web Authentication CWA with FlexConnect Access Points APs is one of the a component for configuring Central Web Authentication using wireless access points. A securit...

Cisco Prime Collaboration Provisioning Access Control Bypass Vulnerability (CNVD-2018-11307)

Cisco Prime Collaboration Provisioning PCP is a reliable and scalable Web-based provisioning solution for managing your company's critical next-generation communications services. An access control bypass vulnerability exists in the web interface of Cisco Prime Collaboration Provisioning PCP. The...

Cisco Prime Collaboration Provisioning Access Control Bypass Vulnerability

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning PCP could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an...

BaserCMS Access Privilege Bypass Vulnerability

baserCMS is an enterprise-level content management system CMS. A privilege bypass vulnerability exists in baserCMS versions 4.1.0.1 and earlier and 3.0.15 and earlier, which stems from the program failing to restrict access. A remote attacker can exploit this vulnerability to bypass access...

Cybozu Office Operation Restriction Bypass Vulnerability

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operation restriction bypass vulnerability exists in Cybozu Office versions 10.0.0 through 10.8.0. An attacker can exploit the vulnerability to bypass access restrictions and write to or access data that is not ye...

Etherpad Lite Access Control Bypass Vulnerability

Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A security vulnerability exists in the webaccess.js file in Etherpad Lite versions prior to 1.6.4. A remote attacker can exploit this vulnerability by sending a specially crafted request to...

CVE-2018-0548

Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors...

CVE-2018-9230

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall...

ownCloud 'OpenID' Access Control Bypass Vulnerability - Linux

ownCloud is prone to an access control bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

GLSA-201803-05 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201803-05 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details. Impact :...

Drupal Access Control Bypass Vulnerability (CNVD-2018-04729)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Drupal. An attacker can exploit this vulnerability to bypass access control...

Drupal Access Control Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Settings Tray module is one of the Tray settings modules. A security vulnerability exists in the Settings Tray module in Drupal. An attacker can exploit this vulnerability to update...