Access Control Bypass

chakracore is vulnerable to access control bypass. A memory corruption allows an attacker to bypass access controls and potentially obtain confidential information...

OpenAsset Digital Asset Management Input Validation Error Vulnerability

Openasset is a digital asset management software for the website building industry from Openasset UK. OpenAsset Digital Asset Management suffers from an input validation error vulnerability that allows an attacker to spoof it using the x - forward - for directive in the header. By providing a loc...

PT-2020-20370

Name of the Vulnerable Software and Affected Versions Gerrit versions prior to 2.14.22 Gerrit versions prior to 2.15.21 Gerrit versions prior to 2.16.25 Gerrit versions prior to 3.0.15 Gerrit versions prior to 3.1.10 Gerrit versions prior to 3.2.5 Description An information leak issue exists wher...

HAXX libcurl Information Disclosure Vulnerability

HAXX Haxx libcurl is a free, open source client-side URL transport library from the Swedish company HAXX. The library supports FTP, FTPS, TFTP, HTTP and more. Haxx curl FTP PASV Responses An information disclosure vulnerability exists, which can be exploited by an attacker to bypass access...

PT-2020-5214 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: The issue is related to a security feature bypass in Microsoft Excel, which is associated with access control weaknesses. This can allow an attacker to bypass existing protection...

The vulnerability of the security mechanisms for server account data in Cisco Expressway software using Relay NAT (TURN) allows attackers to gain unauthorized access to protected information.

The vulnerability of the data protection mechanisms of the Cisco Expressway server’s Traversal Using Relay NAT TURN software relates to access control deficiencies. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information...

Aviatrix Controller htaccess Security Control Bypass Vulnerability

Aviatrix Controller is a centralized control panel for orchestrating and managing various network and connectivity solutions. An htaccess security control bypass vulnerability exists in Aviatrix Controller versions prior to R5.4.1290. An attacker can exploit this vulnerability to download files...

PT-2020-5024

Name of the Vulnerable Software and Affected Versions Google Chrome on ChromeOS versions prior to 87.0.4280.66 Description The issue is related to an inappropriate implementation in cryptohome, which is a component of Google Chrome on ChromeOS. This allows a remote attacker who has compromised th...

PT-2020-16678

Name of the Vulnerable Software and Affected Versions FlexDotnetCMS versions prior to 1.5.11 Description The issue allows an authenticated remote attacker to bypass access controls and read and write to existing files outside the web root via directory traversal by entering a .. dot dot path in t...

USN-4623-1 pacemaker vulnerability

Ken Gaillot discovered that Pacemaker incorrectly handled IPC communications permissions. A local attacker could possibly use this issue to bypass ACL restrictions and execute arbitrary code as root...

cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

The vulnerability of the Samba file system arises from an incorrect limitation on the path to the restricted access directory. This allows a malicious user to gain access to files and directories beyond the SMB network paths.

The vulnerability of the Samba file system exists due to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to files and directories beyond the boundaries of the SMB network...

UBUNTU-CVE-2020-25654

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration...

PT-2020-9585

Name of the Vulnerable Software and Affected Versions: Verifone VerixV Pinpad Payment Terminals version QT000530 Description: The issue allows bypass of integrity and origin control for S1G file generation. Recommendations: For Verifone VerixV Pinpad Payment Terminals version QT000530, at the...

CVE-2019-14712: Undefined Security Weakness

Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation...

CVE-2020-4779

A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass security access controls. IBM X-Force ID: 189156...

The vulnerability of the systemd-tmpfiles program in SystemD allows a hacker to circumvent existing access restrictions and expose the protected information.

The vulnerability of the systemd-tmpfiles program in SystemD is related to an incorrect definition of the reference before accessing the file. Exploiting this vulnerability could allow a attacker to circumvent existing access restrictions and disclose sensitive information by disabling the...

CVE-2020-5632

InfoCage SiteShell series Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache...

CVE-2020-25017

An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. Envoy then forwards all of the headers as valid to the upstream component. This issue allows an attacker to subvert any...

DEBIAN-CVE-2020-24660

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package...