CVE-2019-18801

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents leading to a query-of-death scenario or may be used to bypass Envoy's...

PT-2019-15673

Name of the Vulnerable Software and Affected Versions Envoy version 1.12.0 Description An issue allows an untrusted remote client to send HTTP/2 requests that can write to the heap outside of the request buffers when the upstream is HTTP/1. This can lead to corruption of nearby heap contents or...

CVE-2019-18801: Out-of-bounds Write

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents leading to a query-of-death scenario or may be used to bypass Envoy's...

CVE-2019-18801

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents leading to a query-of-death scenario or may be used to bypass Envoy's...

Access Control Bypass Vulnerability in Zendo Project Management System

Zendo is China's first open source project management software. It integrates product management , project management , quality management , document management , organization management and transaction management. Zendo Project Management System has an arbitrary file read vulnerability that can ...

The vulnerability of the mod_ssl component in the Apache HTTP Server web server allows attackers to circumvent the configured access control restrictions.

The vulnerability of the modssl component in the Apache HTTP Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent established access control restrictions when using client certificate verification with TLSv1.3...

Red Hat FreeIPA Access Control Bypass Vulnerability

Red Hat FreeIPA is an integrated security information management solution from Red Hat, Inc. The product mainly for Linux and Unix computer networks to provide identity management, policy management and audit management IPA and other functions. A security vulnerability exists in Red Hat FreeIPA...

XML External Entity (XXE) Injection Payload List

An XML External Entity XXE attack sometimes called an XXE injection attack is a type of attack that abuses a widely available but rarely used feature of XML parsers. Using XXE, an attacker is able to cause Denial of Service DoS as well as access local and remote content and services. XXE can be...

httpd: mod_auth_digest: access control bypass due to race condition

A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...

httpd: mod_auth_digest: access control bypass due to race condition

A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...

CVE-2018-21031

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

PT-2019-10458

Name of the Vulnerable Software and Affected Versions Tautulli versions 2.1.38 and below Description The issue allows remote attackers to bypass intended access control because the X-Plex-Token is mishandled and can be retrieved from Tautulli. Recommendations For Tautulli versions 2.1.38 and belo...

CVE-2018-21031: Insufficiently Protected Credentials

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

CVE-2019-4329

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

GHSA-8687-VV9J-HGPH Improper Input Validation in Automattic Mongoose

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

The vulnerability of the Security component in Java SE and Java SE Embedded software platforms allows a perpetrator to gain unauthorized access to information.

The vulnerability of the Security component in Java SE and Java SE Embedded software-related programs is related to deficiencies in access control. Exploiting this vulnerability may allow an attacker operating remotely to gain unauthorized access to information...

CVE-2019-17426

Automattic Mongoose up to version 5.7.4 is affected. The root cause is that a query object containing a _bsontype attribute is ignored, which can bypass access control in some applications (e.g., a query filter interference with _bsontype). The CVE covers this behavior in older versions of the bs...

CVE-2019-17426

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

Automattic Mongoose Access Control Bypass Vulnerability

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. An access control bypass vulnerability exists in Automattic Mongoose 5.7.4 and earlier versions, which can be exploited by an attacker to bypass access control...

CVE-2019-17426: Undefined Security Weakness

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...