3850 matches found
PT-2020-14033
Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality. This could potentially allow execution...
CVE-2020-5906
In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy SCP protocol access to read and overwrite blacklisted files via SCP...
CVE-2020-5582
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to alter the data for the file attached to Report via unspecified vectors...
CVE-2020-5583
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data via unspecified vectors...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41168)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.1. The vulnerability can be exploited by an attacker to bypass access control with the Message slash / command...
CVE-2018-21254
Mattermost Server before 5.1 contains a vulnerability where an attacker can bypass access control for direct-message channel creation via the Message slash command. Affected component: Mattermost Server (pre-5.1). Root cause and exact underlying mechanism are not detailed in the provided document...
CVE-2018-21254
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...
CVE-2019-20859
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input...
CVE-2019-20859: Undefined Security Weakness
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input...
CVE-2018-21254: Incorrect Permission Assignment for Critical Resource
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...
PT-2020-10822
Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.15.0 Description An issue allows login access control to be bypassed via crafted input. Recommendations For versions prior to 5.15.0, update to version 5.15.0 or later to resolve the issue...
PT-2020-8897
Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered that allows an attacker to bypass intended access control for direct-message channel creation via the Message slash command. Recommendations For versions prior to 5.1,...
Apache HTTP Server Vulnerabilities Jan 2019 - Apr 2020
Summary Symantec Web Security Group WSG products using affected versions of Apache HTTP Server may be susceptible to multiple vulnerabilities. A remote attacker can bypass security controls, modify the behavior of HTTP Server configuration, obtain information from the server process memory, perfo...
CVE-2020-3222: Undefined Security Weakness
A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control restrictions on an affected device. The vulnerability is due to the presence of a proxy service at a specific endpoint of the web UI. An...
PT-2020-2680
Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web-based user interface of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control restrictions on an affected...
CVE-2020-10136 IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic
IP-in-IP protocol specifies IP Encapsulation within IP standard RFC 2003, STD 1 that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing...
CVE-2020-10136: Authentication Bypass by Spoofing
IP-in-IP protocol specifies IP Encapsulation within IP standard RFC 2003, STD 1 that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing...
PT-2020-3057
Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software affected versions not specified Description The issue is related to the IP-in-IP protocol, which is vulnerable to spoofing and access-control bypass due to the lack of validation for network packets before decapsulation an...
Pulseaudio Access Control Bypass Vulnerability
PulseAudio is an open source audio system for POSIX OS. The system is primarily used for audio transmission, among other things. A security vulnerability exists in PulseAudio. An attacker could exploit this vulnerability to bypass access control and record audio...