httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

CentOS Errata and Security Advisory CESA-2019:2343 An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

The vulnerability of the component responsible for checking the protocols of Microprogrammable Network Interface Cards from Cisco Firepower Threat Defense allows attackers to circumvent existing access control policies.

The vulnerability of the component responsible for processing SSL/TLS messages in Cisco Firepower Threat Defense microprogramming systems arises from errors in their processing of these messages. Exploiting this vulnerability allows a malicious actor to bypass existing access control policies by...

Knowage Access Control Bypass Vulnerability

Knowage is a suite of open source tools for modern business analytics. An access control bypass vulnerability exists in Knowage 6.1.1 and earlier versions. An attacker can exploit this vulnerability to bypass access control and gain access to the entire application...

CVE-2019-13188

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application...

CVE-2019-12262

Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handling of unsolicited Reverse ARP replies Logical Flaw...

Oracle Linux 8 : httpd:2.4 (ELSA-2019-0980)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-0980 advisory. - Resolves: 1695431 - CVE-2019-0211 httpd: privilege escalation from modules scripts - Resolves: 1696090 - CVE-2019-0215 httpd:2.4/httpd: modssl: acces...

CVE-2019-11653

The CVE-2019-11653 entry affects Micro Focus Content Manager versions 9.1, 9.2, and 9.3 and is described as a Remote Access Control Bypass that could allow manipulation of data stored during another user’s CheckIn request. The connected records (RH, NVD, NVD duplicates) confirm the affected produ...

httpd: mod_auth_digest: access control bypass due to race condition

A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...

CVE-2019-7950

An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially...

Improper access control

An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially...

CVE-2019-7950

CVE-2019-7950 affects Magento 2.x before specific patch levels: 2.1 < 2.1.18, 2.2 < 2.2.9, and 2.3

CVE-2019-1010161

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in decodejws. The attack vector is: network connectivitycrafting user-controlled input to bypass authentication. The fixed...

The vulnerability of the vGate platform protection tool, which allows intruders to influence the integrity and accessibility of information.

The vulnerability of the vGate virtualization platform’s security device stems from bypassing access control rules by performing unauthorized operations in the SKALA-R environment. Exploiting this vulnerability allows attackers to compromise the integrity and accessibility of information...

The vulnerability of the NX-OS network operating system, related to lack of access control, allows attackers to bypass security checks and connect unauthorized servers to the VLAN infrastructure.

The vulnerability of the network operating system NX-OS, which operates on Cisco Nexus 9000 Series ACI Mode Switches, is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to bypass security checks and connect unauthorized servers to the VLAN...

Cisco NX-OS Software Bash Shell Role-Based Access Control Bypass Privilege Escalation Vulnerability

According to its self-reported version, a bash shell implementation for Cisco NX-OS software is affected access control bypass privilege vulnerability. An authenticated local attacker can escalate their privilege level by executing commands authorized to other user roles. TRUSTED...

ZEIT: Access control bypass leads to domain information disclosure

Summary: By leveraging the domain verification endpoint I can obtain sensitive information about the user who registered the domain within the zeit UI including username, email address, userId, and customerId. In addition, some high level information about the domain is included as well such as...

Joomla! 3.6.x < 3.9.7 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A CSV injection exists in versions 3.9.0 to 3.9.6 within the CSV export of comactionslogs - A cross-site scripting XSS vulnerability exists in versions 3.6.0 to 3.9.6 due to...

The vulnerability in the syntax analyzer of Cisco Firepower Management Center’s network management software for Secure Sockets Layer (SSL) and Transport Layer Security (TLS protocols allows a perpetrator to bypass existing access control policies.

The vulnerability in the syntax analyzer of Cisco Firepower Management Center’s network management software for Secure Sockets Layer SSL and Transport Layer Security TLS protocols is related to errors in analyzing attributes in TLS packet headers. Exploiting this vulnerability can allow a malicio...

VulnCheck KEV: CVE-2017-5174

An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution...

Google Chrome Privilege Permission and Access Control Issues Vulnerability

Google Chrome is a web browser from Google, an American company. A Permission Grant and Access Control Issue vulnerability exists in versions of Google Chrome prior to 75.0.3770.80 for Android-based platforms, which can be exploited by an attacker to bypass security restrictions and gain...