CVE-2021-30080: Undefined Security Weakness

An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control...

Beego 安全漏洞

Beego is an open source web framework based on the Go language. A security vulnerability existed prior to Beego 2.0.1 that stemmed from a route lookup process that allowed an attacker to bypass access control...

Huawei EulerOS: Security Advisory for keepalived (EulerOS-SA-2022-1351)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : keepalived (EulerOS-SA-2022-1351)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

CVE-2021-3814

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure...

CVE-2022-22394

The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By signing in, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrator or node access to the...

CVE-2022-22394: Undefined Security Weakness

The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By signing in, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrator or node access to the...

CVE-2022-23730

The public API error causes for the attacker to be able to bypass API access control...

CVE-2022-23730: Improper Access Control

The public API error causes for the attacker to be able to bypass API access control...

EulerOS 2.0 SP9 : keepalived (EulerOS-SA-2022-1291)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

EulerOS 2.0 SP9 : keepalived (EulerOS-SA-2022-1307)

According to the versions of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and...

Access-Control Bypass

lemonldap is vulnerable to access control bypass. The vulnerability exists due to the RESTServer pwdConfirm always returns true with Combination + Kerberos...

PT-2022-3649 · Unknown +5 · 389-Ds-Base +5

Name of the Vulnerable Software and Affected Versions: 389-ds-base affected versions not specified Description: The issue is related to an access control bypass vulnerability. It involves the mishandling of a filter that yields incorrect results, allowing any remote unauthenticated user to issue ...

Recent Cyberattacks Target Open-source Web Servers

Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies...

The vulnerability in the implementation of Mozilla Firefox browser extensions allows a perpetrator to circumvent established security restrictions.

The vulnerability of Mozilla Firefox browser extensions is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by bypassing the permission request window during the installation of extensions...

CVE-2021-45106

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

XWiki Platform 安全漏洞

Xwiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company Xwiki. A security vulnerability exists in XWiki Platform that stems from the fact that in the affected version, any user with editing privileges can copy the content of a page to which...

CVE-2021-45106: Use of Hard-coded Credentials

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

PT-2022-6314

Name of the Vulnerable Software and Affected Versions SICAM TOOLBOX II versions prior to the fixed version Description A vulnerability has been identified in SICAM TOOLBOX II, related to insufficient protection of the data transmission control protocol. This could allow an attacker to access the...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...