In Keepalived through 2.2.4 the D-Bus policy does not sufficiently restrict the message destination allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

...

CVE-2021-44225

A flaw was found in keepalived, where an improper authentication vulnerability allows an unprivileged user to change properties that could lead to an access-control bypass...

Access Control Bypass

Overview latte/latte is an intuitive and fast template engine for those who want the most secure PHP sites. Introduces context-sensitive escaping. Affected versions of this package are vulnerable to Access Control Bypass. There is a way to bypass allowFunctions that will affect the security of th...

DEBIAN-CVE-2021-44225

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

CVE-2021-44225

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

AZL-6508 CVE-2021-44225 affecting package keepalived for versions less than 2.2.7-1

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

PT-2021-7761

Name of the Vulnerable Software and Affected Versions Keepalived versions 2.2.4 and earlier Description The issue is related to insufficient restrictions in the D-Bus policy, allowing any user to inspect and manipulate properties. This can lead to access-control bypass in certain situations where...

CVE-2021-44225

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

CVE-2021-44225: Undefined Security Weakness

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

Keepalived 安全漏洞

Keepalived is a set of routing software written in C by the Keepalived organization. The software is primarily used for load balancing and fault detection, among other things. Keepalived 2.2.4 suffers from a security vulnerability that stems from a D-Bus policy that does not sufficiently restrict...

CVE-2021-20841

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

The vulnerability of the Windows Fast FAT File System Driver allows attackers to circumvent security restrictions and increase their privileges.

The vulnerability of the Windows Fast FAT File System Driver in the operating system Windows is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to bypass security restrictions and gain elevated privileges...

CVE-2021-41244: Externally Controlled Reference to a Resource in Another Sphere

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a...

rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string

A flaw was found in rust. Extraneous zero characters at the beginning of an IP address string are not properly considered which can allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity...

PT-2021-23652

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description An incorrect access control issue exists in the Sourcecodester Engineers Online Portal in PHP, specifically in the nia munoz monitoring system/admin/uploads...

CVE-2021-43264

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

Mahara 路径遍历漏洞

Mahara is a social networking system. The system includes a blog, resume builder, file manager, and more. Mahara suffers from a security vulnerability that allows an attacker to bypass the intended access control on HTML files through directory traversal...

CVE-2021-43264: Improper Limitation of a Pathname to a Restricted Directory

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

PT-2021-23787

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 20.04.5 Mahara versions prior to 20.10.3 Mahara versions prior to 21.04.2 Mahara versions prior to 21.10.0 Description The issue allows attackers to bypass the intended access control for HTML files via directory...

FreeBSD : Gitlab -- Multiple Vulnerabilities (33557582-3958-11ec-90ba-001b217b3468)

Gitlab reports : Stored XSS via ipynb files Pipeline schedules on imported projects can be set to automatically active after import Potential Denial of service via Workhorse Improper Access Control allows Merge Request creator to bypass locked status Projects API discloses ID and name of private...