PT-2013-3617

Name of the Vulnerable Software and Affected Versions Moodle versions 2.1.10 and earlier, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1 Description The issue allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat...

PT-2013-2215

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 2013.1 OpenStack Keystone Folsom version 2012.1.3 and earlier OpenStack Keystone Essex Description The issue allows context-dependent attackers to bypass access restrictions by not properly checking if the...

PT-2013-3049

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 Description An issue exists where access controls for a SharePoint list are not properly established, allowing remote authenticated users to bypass intended restrictions on reading list items. This is related t...

389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible)

389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry...

OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the...

Discuz! X2 回复仅作者可见控制不严

简要描述： Discuz! X2 发布回复仅作者可见的主题帖，普通会员可以绕过该机制获得被隐藏的部分内容 详细说明： 帖子为打开状态时，可以通过楼层获得fid、tid、repposet 这3个参数，手动URL提交，可获取引用回复，引用回复中含有被屏蔽（仅作者可见的）部分内容。 漏洞证明： 拼接的url...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

DEBIAN-CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

DEBIAN-CVE-2012-5573

The connectionedgeprocessrelaycell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service memory consumption or excessive cell reception rate or bypass intended flow-control...

CVE-2012-5573

The connectionedgeprocessrelaycell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service memory consumption or excessive cell reception rate or bypass intended flow-control...

UBUNTU-CVE-2012-5573

The connectionedgeprocessrelaycell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service memory consumption or excessive cell reception rate or bypass intended flow-control...

PT-2013-1941

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG versions prior to 1.2.3 Description The issue allows remote attackers to bypass intended access-control restrictions via crafted SAML data, due to the lack of signature-verification capability of the Lasso library. Recommendation...

CVE-2012-6426: Undefined Security Weakness

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

PT-2013-1807

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.2.3.25 Description The issue allows remote attackers to potentially cause a denial of service or bypass flow-control restrictions. This could lead to memory consumption or an excessive cell reception rate via a RELAY...

Mozilla Thunderbird < 16.0 Multiple Vulnerabilities

The installed version of Thunderbird is earlier than 16.0 and thus, is affected by the following vulnerabilities : - Several memory safety bugs exist in the browser engine used in Mozilla-based products that could be exploited to execute arbitrary code. CVE-2012-3983 - '' elements can be abused t...

CVE-2012-4408: Undefined Security Weakness

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation...

PT-2012-1348

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.0.3 Description The issue concerns the XML-RPC remote publishing interface in WordPress, which fails to properly check user capabilities. This allows remote authenticated users with the Author or Contributor role ...

PT-2012-5502

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator ePO versions 4.6.1 and earlier Description The issue allows remote authenticated users to bypass intended access restrictions and obtain sensitive information from arbitrary reporting panels. This is achieved by...

DEBIAN-CVE-2012-3417

The goodclient function in rquotad rquotasvc.c in Linux DiskQuota aka quota before 3.17 invokes the hostsctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny...

CVE-2012-3391

mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a...