CVE-2020-5250: Improper Authorization

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the idaddress in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the idcustomer and change all information of all accounts. The problem is...

CVE-2020-5251: Improper Authorization

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way...

Kubernetes: Grafana Improper authorization

Summary: new report from part2. wrong configuration causes Grafana datasource to use root userwith influxdb admin priv. Component Version: test-infra:master Steps To Reproduce: in normally configuration read-only user used by grafana, but in my test i found datasource user wite admin perms. refer...

ICSA-20-051-01_B&R Automation Studio and Automation Runtime

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: B&R Industrial Automation GmbH Equipment: Automation Studio and Automation Runtime Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a...

CVE-2020-1791

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185C00E74R3P8 have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode...

Authorization

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185C00E74R3P8 have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode...

CVE-2020-1882

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180C185E6R3P3, earlier than 10.0.0.180C432E6R1P7, earlier than 10.0.0.180C636E5R2P3; HUAWEI Mate 20 RS versions earlier than 10.0.0.175C786E70R3P8; HUAWEI Mate 20 X versions earlier than 10.0.0.176C00E70R2P8; and Honor Magic2 versions...

CVE-2020-1882

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180C185E6R3P3, earlier than 10.0.0.180C432E6R1P7, earlier than 10.0.0.180C636E5R2P3; HUAWEI Mate 20 RS versions earlier than 10.0.0.175C786E70R3P8; HUAWEI Mate 20 X versions earlier than 10.0.0.176C00E70R2P8; and Honor Magic2 versions...

Authorization

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180C185E6R3P3, earlier than 10.0.0.180C432E6R1P7, earlier than 10.0.0.180C636E5R2P3; HUAWEI Mate 20 RS versions earlier than 10.0.0.175C786E70R3P8; HUAWEI Mate 20 X versions earlier than 10.0.0.176C00E70R2P8; and Honor Magic2 versions...

PT-2020-15063

Name of the Vulnerable Software and Affected Versions HUAWEI Mate 20 smartphones versions prior to 10.0.0.185C00E74R3P8 Description The system has a logic judging error under certain scenarios, which could allow an attacker to switch to the third desktop after a series of operations in ADB mode...

CVE-2020-1791: Undefined Security Weakness

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185C00E74R3P8 have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode...

openSUSE Security Update : nextcloud (openSUSE-2020-220)

This update for nextcloud fixes the following issues : Nextcloud was updated to 15.0.14 : - NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes boo1162766 - NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caus...

CVE-2020-1882

CVE-2020-1882 affects several Huawei Android devices with an improper authorization vulnerability. Affected: Huawei Ever‑L29B devices pre 10.0.0.180 (C185E6R3P3, C432E6R1P7, C636E5R2P3); Huawei Mate 20 RS pre 10.0.0.175 (C786E70R3P8); Huawei Mate 20 X pre 10.0.0.176 (C00E70R2P8); Honor Magic2 pre...

CVE-2020-1882

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180C185E6R3P3, earlier than 10.0.0.180C432E6R1P7, earlier than 10.0.0.180C636E5R2P3; HUAWEI Mate 20 RS versions earlier than 10.0.0.175C786E70R3P8; HUAWEI Mate 20 X versions earlier than 10.0.0.176C00E70R2P8; and Honor Magic2 versions...

PT-2020-15139

Name of the Vulnerable Software and Affected Versions Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180 HUAWEI Mate 20 RS versions earlier than 10.0.0.175 HUAWEI Mate 20 X versions earlier than 10.0.0.176 Honor Magic2 versions earlier than 10.0.0.175 Description The issue is related...

CVE-2020-1882: Undefined Security Weakness

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180C185E6R3P3, earlier than 10.0.0.180C432E6R1P7, earlier than 10.0.0.180C636E5R2P3; HUAWEI Mate 20 RS versions earlier than 10.0.0.175C786E70R3P8; HUAWEI Mate 20 X versions earlier than 10.0.0.176C00E70R2P8; and Honor Magic2 versions...

Nextcloud server improper authorization vulnerability

Nextcloud is a client-server software suite for creating network hard disks. An improper authorization vulnerability exists in Nextcloud Server 17.0.0. An attacker can exploit the vulnerability to cause preview and file disclosure when opening a file to place a share link via the Gallery...

CVE-2019-20402

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

CVE-2019-20404

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability...

CVE-2019-20402

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...