Debian: Security Advisory (DSA-4357-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-20155

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings...

IBM Security Access Manager Application Control Bypass Vulnerability

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. An application control bypass vulnerability exists in IBM Security Access Manager...

ZTE Home Gateway ZXHN H168N 2.2 Access Control Bypass Vulnerability

ZTE Home Gateway ZXHN H168N suffers from multiple access bypass and information disclosure vulnerabilities. POC: CVE-2018-7357 and CVE-2018-7358 Disclaimer: This POC is for Educational Purposes , I would Not be responsible for any misuse of the information mentioned in this blog post +...

ZTE Home Gateway ZXHN H168N 2.2 Access Control Bypass

POC: CVE-2018-7357 and CVE-2018-7358 Disclaimer: This POC is for Educational Purposes , I would Not be responsible for any misuse of the information mentioned in this blog post + Unauthenticated + Author: Usman Saeed usman at xc0re.net + Protocol: UPnP + Affected Harware/Software: Model name: ZXH...

CVE-2018-19754

Tarantella Enterprise before 3.11 allows bypassing Access Control...

CVE-2018-19754: Missing Authorization

Tarantella Enterprise before 3.11 allows bypassing Access Control...

PT-2018-15070

Name of the Vulnerable Software and Affected Versions Tarantella Enterprise versions prior to 3.11 Description The issue allows bypassing Access Control, which could lead to unauthorized access. Recommendations For versions prior to 3.11, update to version 3.11 or later to resolve the issue...

USN-3833-1 linux-aws vulnerabilities

Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. CVE-2018-18955 Philipp Wendler discovered that the overlayfs implementati...

PT-2018-2506

Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.26 Description The issue is related to a type confusion in the setcolorspace, allowing remote attackers to bypass intended access restrictions. This is due to errors in the setcolorspace type. The exploitation o...

Microsoft Windows Security Bypass and Latest Servicing Stack Updates-Defense in Depth (KB4465659)

This host is missing an important security update according to Microsoft KB4465659. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

IBM DB2 Access Control Vulnerability

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBM i, z/OS, and Windows server versions. A security vulnerability exists in all revision packages of IBM DB2 version 11.1 including DB2 Connec...

PT-2018-2302

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.15.x through 4.19.x before 4.19.2 Description The issue is related to the map write function in kernel/user namespace.c, which mishandles nested user namespaces with more than 5 UID or GID ranges. This allows a user wit...

Atlassian JIRA XSRF, Open Redirect, and Access Control Bypass Vulnerabilities

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Exploit for Path Traversal in Apache Tomcat_Jk_Connector

CVE-2018-11759https://cve.mitre.org/cgi-bin/cvename.cgi?nam...

CVE-2018-11759: Improper Limitation of a Pathname to a Restricted Directory

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...

UBUNTU-CVE-2018-14432

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all...

GHSA-686G-3XR3-X4X6 Information Exposure on Case Insensitive File Systems in serve

Versions of serve before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems. Recommendation Update to version 7.0.0 or later...

CVE-2018-0384: Protection Mechanism Failure

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly...

HackerOne: Ajouter le même utilisateur que celui déjà inscrit dans les équipes

Description: Possibilité d'ajouter le même utilisateur que celui déjà inscrit dans les équipes. Steps To Reproduce 1. Aller sur https://hackerone.com/teamname/teammembers 2. Observer les emails des utilisateurs. 3. Utiliser le même email que celui précédemment inscrit, mais varier les majuscules ...