PT-2020-2779

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 11.0.4 Description The issue is related to the core/get menudiv.php component in Dolibarr, which lacks proper input validation. This allows remote authenticated attackers to bypass intended access restrictions by...

PT-2020-23059

This module enables you to build forms and surveys in Drupal. The Webform Node sub-module allows these forms to be associated with a Drupal node. The Webform Node module does not implement access checking in the same manner as other nodes and entities. As such, writers of custom modules which...

Joomla Authorization RCE Vulnerability (CNVD-2020-25051)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development of open source , cross-platform content management system CMS. source, cross-platform content management system CMS. An authorized RCE vulnerability exists in Joomla, which can be exploited by attackers to bypass...

CVE-2019-15793

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into inituserns, whereas they should have been translated in...

CVE-2019-15793

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into inituserns, whereas they should have been translated in...

CVE-2019-15793: Insertion of Sensitive Information into Externally-Accessible File or Directory

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into inituserns, whereas they should have been translated in...

CVE-2019-12524

CVE-2019-12524 concerns Squid up to version 4.7 where the Cache Manager block relies on a url_regex rule that decodes incoming requests. An attacker can craft an encoded URL to bypass the url_regex check and access the blocked Cache Manager resource. Affects Squid’s request handling path and deco...

Access Control Bypass

gdm is vulnerable to access control bypass. A flaw was found in the way the gdm package was built. The gdm package was missing TCP wrappers support, which could result in an administrator believing they had access restrictions enabled when they did not...

Access Control Bypass

tog-pegasus is vulnerable to access control bypass. After re-basing to version 2.7.0 of the OpenGroup Pegasus code, these additional security enhancements were no longer being applied. As a consequence, access to OpenPegasus WBEM services was not restricted to the dedicated users as described in...

Access Control Bypass

dovecot is vulnerable to access control bypass. A flaw was found in Dovecot's ACL plug-in. The ACL plug-in treated negative access rights as positive rights, which could allow an attacker to bypass intended access restrictions...

Access Control Bypass

kernel is vulnerable to access control bypass. A missing check for files opened with OAPPEND in the syssplice could allow a local, unprivileged user to bypass the append-only file restrictions...

Zoom Client for Meetings < 4.6.9.19273.0402 Multiple Vulnerabilities (macOS)

The version of Zoom Client for Meetings installed on the remote macOS or Mac OS X host is prior to 4.6.9.19273.0402 and is therefore affected by multiple vulnerabilities. - A privilege escalation vulnerability exists in the Zoom client due to a 'runwithroot' file being placed in a user-writable...

Kentico CMS < 9.0.51 / 10.x < 10.0.48 Access Control Bypass

Kentico CMS is a common ASP.NET Content Management System CMS used for building websites and online stores. Kentico CMS versions before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to gain Global Administrator access by visiting CMSInstall/install.aspx and then browsing the CMS...

Unspecified vulnerability in Apple macOS Catalina autofs component

Apple macOS Catalina is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in the autofs component in Apple macOS Catalina versions prior to 10.15.3. An attacker could exploit the vulnerability to bypass access control...

envoy: TLS inspector bypassc

An access control bypass vulnerability was found in envoy. An attacker could send specially crafted packets over TLS v1.3 to possibly bypass security restrictions...

CVE-2019-14071

Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect secure or non-secure ram dumps in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

CVE-2019-14071

CVE-2019-14071 affects Qualcomm/Snapdragon components where the reset handler can bypass access control if the AC configuration is reset while debug path for RAM dumps is enabled. The issue is described across multiple sources (NVD, Red Hat, PRION, CIRCL) with same core summary, listing affected ...

PT-2020-9494

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions in APQ8017, APQ8053, APQ8096, APQ8096AU, IPQ6018, MDM9205, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QM215, Rennell, SA6155P, SC8180X,...

CVE-2019-14071: Undefined Security Weakness

Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect secure or non-secure ram dumps in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

CVE-2020-10100: Undefined Security Weakness

An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket da...