Sales & Company Management System Privilege Permission and Access Control Vulnerability

Sales & Company Management System SCMS is a sales and company management system. The system includes features such as customer management, product management and tax management. A privilege permission and access control vulnerability exists in SCMS 2018-06-06 and prior versions, which can be...

TOTOLINK A3002RU Access Control Error Vulnerability

The TOTOLINK A3002RU is an AC1200 wireless dual-band Gigabit router. An access control error vulnerability exists in formPasswordSetup in TOTOLINK A3002RU version 1.0.8, which can be exploited by an attacker to change the password of an administrator user via an unauthenticated POST request...

CVE-2018-13319

Incorrect access control in getportalinfo in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request...

CVE-2018-19411

PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account including administrator via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights...

Nextcloud Server Access Control Error Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. An Access Control Error vulnerability exists in Nextcloud Server versions prior to 14.0.0, 13.0.6, and 12.0.11, which c...

Huawei Watch Privilege Control Vulnerability

Huawei Watch 2 is Huawei's second generation smart sports watch. A privilege control vulnerability exists in Huawei Watch 2. Due to misconfiguration of privileges for specific operations, an attacker who has been informed that the watch is bound to a Huawei account can bypass privilege checking b...

The vulnerability of the FortiOS operating system, caused by access control errors, allows a hacker to execute arbitrary code.

Vulnerability of the FortiOS operating system caused by access control errors. Exploiting this vulnerability allows a attacker to execute arbitrary code by placing it on a USB drive connected to the FortiGate, through the allowed fnsysctl program...

Microsoft Edge’s vulnerability, related to access control deficiencies, allows attackers to elevate their privileges and escape from the isolated software environment.

The vulnerability of Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges and escape from the isolated software environment of AppContainer...

GHSA-H5F5-RJ4R-42F6 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password...

Teltonika RUT9XX Arbitrary Command Execution Vulnerability

Teltonika RUT9XX routers also known as LuCI is a router product from the Lithuanian company Teltonika. An arbitrary command execution vulnerability exists in Teltonika RUT9XX with firmware version lower than 00.04.233, which is caused by the program's failure to perform proper access control and...

PYSEC-2018-69

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity...

CVE-2018-0425

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is...

Cisco RV110W, RV130W, RV215W Information Disclosure Vulnerabilities

The RV110W is a Wireless-N VPN firewall router.The RV130W is a Wireless-N multifunction VPN router.The RV215W is a Wireless-N VPN router. An information disclosure vulnerability exists in the Web-based management interface of the Cisco RV110W, RV130W, and RV215W routers. The vulnerability stems...

CVE-2018-7792

A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to decode the password using rainbow table...

The vulnerability of Diagnostics Hub Standard Collector and Visual Studio Standard Collector on Windows operating systems allows a perpetrator to create files

The vulnerability of the Diagnostics Hub Standard Collector and Visual Studio Standard Collector for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability allows an attacker to create files at any desired location on the disk using a specially creat...

HPE RESTful Interface Tool Privilege Permission and Access Control Vulnerability

HPE RESTful Interface Tool is a suite of RESTful interface tools from Hewlett Packard Enterprise HPE that can configure, inventory, and monitor a variety of system and server components, which supports control of power supplies, BIOS legacy/UEFI, and iLO 4 through command tools settings, reading...

Security Bulletin: IBM API Connect is impacted by a Drupal 8 vulnerability (CVE-2018-14773)

Summary IBM API Connect has fixed the following vulnerability. API Connect is impacted by vulnerabilities addressed in the Drupal 8 advisory https://www.drupal.org/SA-CORE-2018-005 Vulnerability Details CVEID: CVE-2018-14773 DESCRIPTION: Drupal Core could allow a remote attacker to bypass securit...

LG Products GNSS Application Access Control Error Vulnerability

LG devices based on Android are smart devices based on the Android platform from the South Korean LG Group.GNSS application is one of the global satellite navigation applications. A security vulnerability exists in the GNSS application in LG products based on the Android platform versions 6.0 to...

LG Products MLT Application Intents Access Control Error Vulnerability

LG devices based on Android are smart devices based on the Android platform from the South Korean LG Group.SystemUI application intents are one of the system applications. A security vulnerability exists in the MLT application intents in LG products based on Android versions 6.0 to 8.1, which...

CVE-2018-1000226

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...