CVE-2017-15044: Undefined Security Weakness

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

PT-2017-3351

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.3.x through 6.3.11 Splunk Enterprise versions 6.4.x through 6.4.8 Splunk Enterprise versions 6.5.x through 6.5.5 Splunk Enterprise versions 6.6.x through 6.6.3.1 Splunk Enterprise versions 7.0.x through 7.0.0.0...

PT-2017-14568

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.3.1 Description The issue allows remote attackers to bypass intended access restrictions or trigger XSS via certain file extensions. This is because the is file acceptable function in...

PostgreSQL Access Control Bypass Vulnerability

PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A security bypass vulnerability exists in PostgreSQL. ...

rsync security bypass vulnerability

rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. A security bypass...

CVE-2014-9148: Improper Access Control

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...

PT-2017-11560

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.6.1 Description The issue allows authenticated attackers to bypass access restrictions and perform arbitrary actions through the "Cabinet" function. Recommendations For Cybozu Office versions 10.0.0...

Piwigo Access Restriction Bypass Vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. An access restriction bypass vulnerability exists in the urlcheckformat in the include/functions.inc.php file in version...

The vulnerability of the eonweb (logout.php) component of the support service program, designed for implementing the library process (ITIL), EyesOfNetwork, allows a hacker to circumvent access control rules.

The vulnerability of the eonweb logout.php component of the support service program, designed for implementing ITIL library processes, relates to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to bypass access restrictions and gain remote...

CVE-2017-14315

In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP Low Energy Audio Protocol, a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attack...

UBUNTU-CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution

Summary WebCTRL®, Automated Logic's web-based building automation system, is known for its intuitive user interface and powerful integration capabilities. It allows building operators to optimize and manage all of their building systems - including HVAC, lighting, fire, elevators, and security -...

OpenJDK: Nashorn incompletely blocking access to Java APIs (Scripting, 8171539)

It was discovered that the Nashorn JavaScript engine in the Scripting component of OpenJDK could allow scripts to access Java APIs even when access to Java APIs was disabled. An untrusted JavaScript executed by Nashorn could use this flaw to bypass intended restrictions...

CVE-2017-6751

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypa...

CVE-2017-6751

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypa...

CVE-2017-6751

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypa...

CVE-2017-6751

Cisco Web Security Appliance (WSA) is affected (virtual and hardware). The issue is a web proxy bypass where traffic forwarded from the web proxy interface to the administrative management interface is not denied, enabling an unauthenticated remote attacker to reach the admin interface (Access Co...

PT-2017-17291

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions 9.0.0-485 through 10.1.0-204 Description A vulnerability in the web proxy functionality could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface to the...

CVE-2017-6751: Improper Input Validation

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypa...

Sony WG-C10 Security Bypass Vulnerability

The Sony WG-C10 is a wireless portable server from Sony Japan. A security vulnerability exists in Sony WG-C10 version 3.0.79 and earlier. An attacker could exploit the vulnerability to bypass access control and obtain or change information stored on an external storage device...