CVE-2020-11661

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...

PT-2020-2528 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP,...

CVE-2020-7278

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

The vulnerability of the “BAR.- ” platform, which is used for creating a unified database and electronic registration of residential properties, stems from an error in access control. This error allows attackers to gain access to the system under the name of another user, including the administrator.

The vulnerability of the “BAR.- ” platform for creating a unified database and electronic registration of residential properties is related to an error in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the system under the name o...

Eclipse Che Unauthorized Access Vulnerability

Eclipse Che is the Eclipse Foundation's set of Java-based open source online integrated development environment IDE. A security vulnerability exists in Eclipse Che 7.8.x and earlier versions that stems from the program not properly restricting access to workspace container groups. An attacker cou...

The vulnerability of the /proc/$PID/ component of the Ubuntu operating system’s apport error logging service allows a malicious actor to create a publicly accessible report of a software bug for a privileged process.

The vulnerability of the /proc/$PID/ component of the Ubuntu operating system’s apport error logging service is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to create a publicly accessible report of the software bug for the privileged process...

Nexus Repository Manager Incorrect Access Control Vulnerability

Nexus Repository Manager is a repository manager from Sonatype that lets you proxy, collect, and manage your dependencies so you don't have to deal with a series of JARs on a regular basis, making it easy to distribute your software. An incorrect access control vulnerability exists in Nexus...

Advantech WebAccess Access Control Error Vulnerability (CNVD-2020-22292)

Advantech WebAccess is a set of HMI/SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An access control error vulnerability exist...

bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable

It was found that the controls for zone transfer were not properly applied to Dynamically Loadable Zones DLZs. An attacker acting as a DNS client could use this flaw to request and receive a zone transfer of a DLZ even when not permitted to do so by the "allow-transfer" ACL...

GitLab EE/CE Access Control Error Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

Mitsubishi Electric MELQIC IU1 TCP Function Access Control Error Vulnerability

The Mitsubishi Electric MELQIC IU1 is an IU1 series data collection analyzer from Mitsubishi Electric Mitsubishi, Japan. An access control error vulnerability exists in the TCP function in the Mitsubishi Electric MELQIC IU1 IU1-1M20-D using firmware version 1.0.7 and earlier. The vulnerability...

PT-2020-11995 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.16 Description: An issue was discovered that allows incorrect access control in the SQL fieldtype of com fields, enabling access for non-superadmin users. Recommendations: For versions prior to 3.9.16, update to...

The vulnerability in the settings of the iw_webs account of the Moxa AWK-3131A wireless access point’s microprogramming software allows a hacker to reset the user’s password for that account.

The vulnerability in the settings of the iwwebs account of the Moxa AWK-3131A wireless access point software-related microprogramming system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to remotely reset the user account password...

The vulnerability of the iw_console component in the wireless access point software for Moxa AWK-3131A industrial systems allows a hacker to elevate their privileges to the root level.

The vulnerability of the iwconsole component in the wireless access device software of Moxa AWK-3131A industrial systems is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

GitLab Access Control Error Vulnerability (CNVD-2020-17388)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

The vulnerability of the Windows Error Reporting service on Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the Windows Error Reporting service on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

Monstra Access Control Error Vulnerability

Monstra is a lightweight content management system CMS. An access control error vulnerability exists in Monstra 3.0.4 and earlier versions. A remote attacker can exploit this vulnerability to take over arbitrary user accounts via the modified login parameter of the edit URI...

CVE-2018-15819

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js...

Cisco Data Center Network Manager elevation of privilege vulnerability (CNVD-2020-10705)

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. An elevation of privilege vulnerability exists in the REST API endpoint of Cisco...

The vulnerability of the Login component of the Oracle Hospitality Opera 5 software, which allows a hacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Oracle Hospitality Opera 5 software for managing hotel resources is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain unauthorized access to protected information usi...