3854 matches found
CVE-2022-22993: Server-Side Request Forgery (SSRF)
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters...
Western Digital My Cloud 代码问题漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud that could allow an attacker to impersonate the server and access any page on the server by bypassing access control...
PT-2022-1759
Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.4.0 through 2.4.1 Description The issue is related to the lack of authentication for a critical function, allowing a remote attacker to bypass security restrictions and access the "/plugin API" endpoint without...
haproxy: request smuggling attack or response splitting via duplicate content-length header
Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while...
IBM WebSphere Application Server Liberty 加密问题漏洞
IBM WebSphere Application Server Liberty is a U.S. IBM company built on the Open Liberty project on top of the Java application server . A security vulnerability exists in IBM WebSphere Application Server Liberty that can be exploited by an attacker to bypass access restrictions to WebSphere AS...
PT-2022-5708 · Symantec · Symantec Endpoint Protection
Name of the Vulnerable Software and Affected Versions: Symantec Endpoint Protection Windows versions prior to 14.3 RU6/14.3 RU5 Patch 1 Description: The issue is related to a Security Control Bypass, which can potentially allow a threat actor to circumvent existing security controls. This...
CVE-2021-28507
An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent...
FastLine Media Beaver Builder 安全漏洞
FastLine Media Beaver Builder is a front-end layout and styling designer from FastLine Media, Inc. It provides a WYSIWYG view when developing content areas. A security vulnerability exists in FastLine Media Beaver Builder, which stems from versions from Beaver Builder to 2.5.0.3, and can be...
haproxy: request smuggling attack or response splitting via duplicate content-length header
Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while...
OESA-2021-1477 keepalived security update
High Availability monitor built upon LVS, VRRP and service pollers. Security Fixes: In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situation...
Netgear NETGEAR R6700v2 授权问题漏洞
NETGEAR R6700v2 is a wireless router from Netgear, Inc. NETGEAR R6700v2 is vulnerable to a permission and access control issue, which stems from the fact that NETGEAR R6700v2 devices prior to version 1.2.0.88 are affected by an authentication bypass. An attacker could exploit this vulnerability t...
Updated keepalived packages fix security vulnerability
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...
CVE-2021-23803 Access Control Bypass
This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters x00-x08 after the function will bypass these restriction...
The vulnerability of the CORS mechanism implementation in Google Chrome browsers allows attackers to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information through a specially created we...
Django 2.2 < 2.2.25, 3.1 < 3.1.14, 3.2 < 3.2.10 Access Control Bypass Vulnerability - Windows
Django is prone to an access control bypass vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...
USN-5188-1: Keepalived vulnerability
It was discovered that Keepalived incorrectly handled certain messages. An attacker could possibly use this issue to access-control bypass...
USN-5188-1 keepalived vulnerability
It was discovered that Keepalived incorrectly handled certain messages. An attacker could possibly use this issue to access-control bypass...
CVE-2021-44420
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths...
USN-5178-1 python-django vulnerability
Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled URLs with trailing newlines. A remote attacker could possibly use this issue to bypass certain access controls...