2827 matches found
The vulnerability of the Ruby on Rails software platform, which allows attackers to circumvent existing access control policies
The vulnerability in the nestedattributes.rb file of the activerecord/lib/activerecord module in the Ruby on Rails software framework is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to bypass existing access restrictions by using nested attributes ...
jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665...
The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions policies.
The vulnerability of the PPBFlashMessageLoopImpl::InternalRun function located in the content/renderer/pepper/ppbflashmessageloopimpl.cc file of the Google Chrome browser plugin for Pepper is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to...
The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions policies.
The vulnerability of the ContainerNode::parserRemoveChild function in the Blink kernel of Google Chrome’s browser is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing access control policies by using a specially crafted websi...
CVE-2016-0222
IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors...
CVE-2016-0222
IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors...
Schneider Electric Building Operation Application Server Operating System Command Injection Vulnerability
Schneider Electric StruxureWare Building Operation Application Server is a set of automation systems for small and medium-sized buildings from the French company Schneider Electric Schneider Electric. An operating system command injection vulnerability exists in Schneider Electric StruxureWare...
Xymon Security Bypass Vulnerability
Xymon is an open source , cross-platform network monitoring application . The application can be viewed through the web page of the operational status of each server , and supports Email and SMS notification function . There is a security vulnerability in Xymon. This vulnerability allows attacker...
Dell OpenManage Server Administrator 8.2 - Authenticated Directory Traversal
Exploit for windows platform in category web applications Exploit Title: Dell OpenManage Server Administrator 8.2 Authenticated Directory Traversal Date: February 22, 2016 Exploit Author: hantwister Vendor Homepage: http://www.dell.com/ Software Link:...
CVE-2016-1905
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object...
The vulnerability in the Microsoft SharePoint Server corporate application suite, a software solution for electronic document management called Microsoft SharePoint Foundation, allows attackers to carry out XSS attacks and circumvent existing access control policies.
The vulnerability of the Microsoft SharePoint Server corporate application and the Microsoft SharePoint Foundation software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and...
The vulnerability in the Microsoft SharePoint Server corporate application suite, a software solution for electronic document management called Microsoft SharePoint Foundation, allows attackers to carry out XSS attacks and circumvent existing access control policies.
The vulnerability of the Microsoft SharePoint Server corporate application and the Microsoft SharePoint Foundation software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and...
CVE-2016-0011
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting XSS attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different...
The vulnerability of the IBM DB2 database management system allows attackers to circumvent existing access restrictions and delete arbitrary rows from tables.
The vulnerability of the Data Movement implementation in the IBM DB2 database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to bypass existing access restrictions and delete arbitrary rows from the tables...
The vulnerability of the Red Hat Enterprise Linux operating system allows a hacker to bypass security restrictions and execute arbitrary code.
The vulnerability of the grub2 loader in the Red Hat Enterprise Linux operating system is related to deficiencies in access control for files. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary code using a specially created multiboot or...
Mozilla Firefox < 42.0 Multiple Vulnerabilities
Binary data 9018.prm...
ntp: drop packets with source address ::1
It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses...
Cisco Connected Grid Network Management System Elevation of Privilege Vulnerability
Cisco Connected Grid Network Management System CG-NMS is an end-to-end smart grid management system from Cisco. A security vulnerability exists in the web GUI of Cisco CG-NMS version 3.00.35 and 3.00.54. A remote attacker can exploit the vulnerability via the Monitor-Only role to bypass establish...
用友企业空间APP权限绕过泄露大量内部资料
简要描述： 也来玩玩移动安全 详细说明： 网址为 http://upesn.com。在web版里只找到几个xss，于是下载了app看看。 然而app用了360的加密，菜鸟表示不知道怎么逆向了。。 smali └── com └── qihoo └── util └── StubApplication.smali 虚拟机运行app抓包，终于找到个有问题的地方： 这里会有个请求： 其中的id就是该企业的公告id，可以通过修改id越权查看其他企业的公告。 用 burp suite 跑了下： 一大堆内部资料。。 漏洞证明： img...