CVE-2017-18376

The Hive vulnerability CVE-2017-18376 is an improper authorization check in the User API (app/controllers/UserCtrl.scala) that lets users with read-only or read/write access escalate to administrator privileges. Affected versions are TheHive before 2.13.4 and 3.x before 3.3.1. Impact details indi...

CVE-2017-18376

An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala...

PT-2019-2799 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.1 through 5.4.10 FortiOS versions 5.6.0 through 5.6.8 FortiOS versions 6.0.0 through 6.0.4 FortiProxy versions 1.0.0 through 1.0.7 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.2.0 through 1.2.8 FortiProxy...

Slims CMS Akasia 8.3.1 SQL Injection

Exploit Title : Slims CMS Akasia 8.3.1 Improper Authorization Vulnerability Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 20/05/2019 Vendor Homepage : slimsetd.id - slims.web.id Software Download Link : slims.web.id/goslims/?wpdmpro=slims-8-3-1-akasia Software...

GHSA-535V-4X9Q-446C Improper Authorization in org.apache.hbase:hbase

In all previously released Apache HBase 2.x versions 2.0.0-2.0.4, 2.1.0-2.1.3, authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. Th...

Improper Authorization

Overview Versions of googleapis prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials. Recommendation Upgrade to version 39.1.0. References - GitHub...

(0Day) (Pwn2Own) Xiaomi Mi6 Browser downloadAndInstallApk Improper Authorization Remote Code Execution Vulnerability

This vulnerability allows network adjacent attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser. User interaction is required to exploit this vulnerability in that the target must connect to a malicious access point. The specific flaw exists within the handling of...

CVE-2019-3785: Cloud Controller provides signed URL with write authorization to read only user | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions CAPI All versions prior to 1.78.0 Description Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read...

jenkins: deleting a user record will does not invalidate existing sessions

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have...

The vulnerability of the map_write() function in “kernel/user_namespace.c” in the Linux operating system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the mapwrite function in “kernel/usernamespace.c” in the Linux operating system is related to improper authorization. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

Jenkins < 2.150.2 LTS / 2.160 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.160 or is a version of Jenkins LTS prior to 2.150.2. It is, therefore, affected by multiple vulnerabilities: An improper authorization vulnerability exists in the Hudson CI tool as part of Jenkins Core due to inadequate...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

CVE-2018-14666

The CVE-2018-14666 describes an improper authorization flaw in the Smart Class feature of Foreman, affecting all Red Hat Satellite 6 versions. The underlying issue allows an attacker to change the configuration of any host registered in Satellite, regardless of organizational boundaries. The impa...

Authorization

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...

CVE-2019-1003004

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have...

CVE-2019-1003003

CVE-2019-1003003 affects Jenkins Core prior to 2.159/2.150.1 LTS. The root cause is an improper authorization in TokenBasedRememberMeServices2.java, enabling attackers with Overall/RunScripts permission to craft Remember Me cookies that never expire, thereby persisting access to a temporarily com...

CVE-2019-1003004

CVE-2019-1003004 affects Jenkins core (including 2.158 and earlier, LTS 2.150.1 and earlier) due to an improper authorization issue in AuthenticationProcessingFilter2.java that can extend an active HTTP session indefinitely, potentially for a user whose account was deleted. The connected records ...

Insecure Authorization

loopback allows unauthorized creation of Authentication Tokens. This is due to improper authorization when the AccessToken model is publicly exposed, allowing an attacker, who has knowledge of any target's userId, to create Authentication Tokens for the victim and gain access to the application a...

CVE-2017-8276

Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD...