Access control bypass in Apache ZooKeeper

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

Anviz M3 RFID Missing Unauthorized Access Vulnerability

Anviz M3 RFID is an access control access controller from Anviz China. A security vulnerability exists in the Anviz M3 RFID. An attacker could exploit this vulnerability to bypass access control and disclose or modify private information...

CVE-2019-5954

JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user's registered information via unspecified vectors...

CVE-2019-5941

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges via the application 'Multi Report'...

CVE-2019-5935

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information...

CVE-2019-1832

A vulnerability in the detection engine of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access control policies. The vulnerability is due to improper validation of ICMP packets. An attacker could exploit this vulnerability by...

Microsoft Windows Latest Servicing Stack Updates-Defense in Depth (KB4500640)

This host is missing an important security update according to Microsoft KB4500640. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

PT-2019-2291 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to improper validation of ICMP packets, which could allow a remote...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

httpd: mod_ssl: access control bypass when using per-location client certification authentication

A flaw was found in Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38. A bug in modssl, when using per-location client certificate verification with TLSv1.3, allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. An attacker could perform vario...

Improper access control

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provide...

CVE-2019-9901

CVE-2019-9901 affects Envoy 1.9.0 and earlier. The vulnerability arises because Envoy does not normalize HTTP URL paths, allowing a remote attacker to craft a relative path (e.g., something/../admin) to bypass access controls and cause a backend to interpret a non-normalized path, potentially gra...

Vulnerability of the Server: Optimizer component of the Oracle MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server: Optimizer component of the Oracle MySQL database management system is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...

Joomla! 1.5.x < 3.9.5 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager component due to improperly sanitizing the folder parameter. An authenticated,...

ALPINE-CVE-2019-0215

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in modssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions...

Apache HTTP Server < 2.4.39 mod_auth_digest Access Control Bypass Vulnerability - Linux

In Apache HTTP Server, a race condition in modauthdigest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be...

Apache HTTP Server < 2.4.39 mod_auth_digest Access Control Bypass Vulnerability - Windows

In Apache HTTP Server, a race condition in modauthdigest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be...

PHP 7.1.x < 7.1.27 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.27. It is, therefore, affected by multiple vulnerabilities: - Uninitialized reads in the EXIF component of PHP due to the mishandling of data in exifprocessIFDinMAKERNOTE, and exifprocessIFDinTIFF...

Apache HTTP Server < 2.4.39 mod_ssl Access Control Bypass Vulnerability - Windows

In Apache HTTP Server a bug in modssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpte...

PHP 7.3.x < 7.3.3 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.3. It is, therefore, affected by multiple vulnerabilities: - Uninitialized reads in the EXIF component of PHP due to the mishandling of data in exifprocessIFDinMAKERNOTE, and exifprocessIFDinTIFF...