3850 matches found
ESA-2014-074: EMC RecoverPoint Appliance Security Control Bypass Vulnerability
ESA-2014-074.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-074: EMC RecoverPoint Appliance Security Control Bypass Vulnerability EMC Identifier: ESA-2014-074 CVE Identifier: CVE-2014-2519 Severity Rating: CVSS v2 Base Score: 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P Affected products: • EMC...
PT-2014-3906
Name of the Vulnerable Software and Affected Versions IBM Algo Credit Limits ACLM versions 4.5.0 through 4.7.0 before 4.7.0.03 FP5 Description The issue relies on client-side input validation, allowing remote authenticated users to bypass intended dual-control restrictions and modify data via a...
CVE-2014-0868: Improper Input Validation
RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by...
CVE-2014-0865: Improper Input Validation
RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limi...
PT-2014-3903
Name of the Vulnerable Software and Affected Versions IBM Algo Credit Limits ACLM versions 4.5.0 through 4.7.0 before 4.7.0.03 FP5 Description The issue relies on client-side input validation, allowing remote authenticated users to bypass intended dual-control restrictions and modify data via...
PHP 3/4/5 Multiple Local And Remote Vulnerabilities (1)
No description provided by source. source: http://www.securityfocus.com/bid/11964/info PHP4 and PHP5 are reported prone to multiple local and remote vulnerabilities that may lead to code execution within the context of the vulnerable process. The following specific issues are reported: A heap-bas...
PHP 3/4/5 Multiple Local And Remote Vulnerabilities (2)
No description provided by source. source: http://www.securityfocus.com/bid/11964/info PHP4 and PHP5 are reported prone to multiple local and remote vulnerabilities that may lead to code execution within the context of the vulnerable process. The following specific issues are reported: A heap-bas...
SourceBans 1.4.7 XSS Vulnerability
No description provided by source. Exploit Title: SourceBans Version 1.4.7 XSS Google Dork: inurl:sourcebans/index.php?p=submit Date: Feb. 9th 2011 Author: Sw1tCh Software Link: http://www.sourcebans.net/ Version: 1.4.7 Info: SourceBans is an application for managing publicly the banned users for...
CVE-2014-0122: Undefined Security Weakness
mod/chat/chatajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstanc...
JP1/File Transmission Server / FTP vulnerable to access control violation
Overview JP1/File Transmission Server/FTP has a vulnerability where an FTP client with limited access rights can bypass the access control and access arbitrary directories on the FTP server when enabling the directory access control function. Impact An attacker with login privileges to the FTP...
Heat: CFN policy rules not all enforced
The cloudformation-compatible API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and 1 create a stack via the CreateStack method or 2 upda...
CVE-2014-0657: Undefined Security Weakness
The administration portal in Cisco Unified Communications Manager Unified CM 9.11 and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540...
CVE-2013-6964
Cisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject content from a different WebEx site via unspecified vectors, aka Bug ID CSCul36197...
PT-2013-6205
Name of the Vulnerable Software and Affected Versions Cisco WebEx Meeting Center affected versions not specified Description The issue allows remote authenticated users to bypass access control and inject content from a different WebEx site. Recommendations At the moment, there is no information...
CVE-2013-6964: Undefined Security Weakness
Cisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject content from a different WebEx site via unspecified vectors, aka Bug ID CSCul36197...
PT-2013-4984
Name of the Vulnerable Software and Affected Versions Make Meeting Scheduler module versions 6.x-1.x before 6.x-1.3 Description The issue allows remote attackers to bypass intended access restrictions for a poll by making a direct request to the node's URL instead of the hashed URL. Recommendatio...
CVE-2013-4379: Undefined Security Weakness
The Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to bypass intended access restrictions for a poll via a direct request to the node's URL instead of the hashed URL...
CVE-2013-4310
Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix...
PT-2013-1358
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.15.1 Description The issue is related to the implementation of the DefaultActionMapper mechanism in Apache Struts, which has weaknesses in access control when handling the action: prefix parameter. This...