Stripo Inc: Able to download any hosted content on AWS S3 bucket(stripo)

An AWS s3 bucket was found, with improper access controls, where all its contents could be downloaded. Steps to reproduce: 1. List contents of the bucket with: aws s3 ls s3://stripo 2. Download the hosted data with : aws s3 sync s3://stripo . Impact Any hosted data can be downloaded to an attacke...

CVE-2019-1622 Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)

According to its self-reported version, this Cisco Small Business RV Series router is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker wi...

CVE-2019-1653 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

Shopify: H1514 Bypass Wholesale account signup restrictions

Summary: By default, account registration is disabled on Shopify Wholesale, requiring customers to be manually invited: Wholesale account signup is disabled. Customers need to be manually invited from the Customers page. This can be bypassed due to improper access controls in the invitation...

CVE-2018-15610 Improper access controls in IP Office one-X Portal

A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2...

CVE-2017-1350

IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administrator due to improper access controls. IBM X-Force ID: 126526...

CVE-2017-1308

IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force ID: 125462...

Improper access control

IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force ID: 125462...

CVE-2017-1302

IBM Sterling B2B Integrator Standard Edition 5.2 could allow a local user view sensitive information due to improper access controls. IBM X-Force ID: 125456...

CVE-2017-1302

IBM Sterling B2B Integrator Standard Edition 5.2 could allow a local user view sensitive information due to improper access controls. IBM X-Force ID: 125456...

CVE-2016-6089

IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926...

Security Bypass Vulnerabilities in Multiple IBM Products (CNVD-2015-07939)

IBM Maximo Asset Management is a product of IBM Corporation.Maximo Asset Management and Maximo Asset Management Essentials are comprehensive asset lifecycle and maintenance management solutions.SmartCloud Control Desk SCCD is a unified asset and service management software.Tivoli IT Asset...

IBM Rational ClearQuest Multiple Information Disclosure Vulnerabilities

This host is installed with IBM Rational ClearQuest and is prone to multiple information disclosure vulnerabilities. OpenVAS Vulnerability Test $Id: gbibmrationalclearquestmultinfodiscvuln.nasl 6093 2017-05-10 09:03:18Z teissa $ IBM Rational ClearQuest Multiple Information Disclosure...

IBM Rational ClearQuest Multiple Information Disclosure Vulnerabilities

IBM Rational ClearQuest is prone to multiple information disclosure vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CruiseWorks and Minna De Office vulnerable in access restrictions

Overview CruiseWorks and Minna De Office are groupware. They contain a vulnerability that the user's access restriction is not properly set. Impact An user with a standard privilege who logs into CruiseWorks or Minna De Office could possibly change the system configurations or information...