2814 matches found
CVE-2017-10046: Improper Privilege Management
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2 and 16.1. Easily exploitable vulnerability allows low privileged attacker with network...
CVE-2017-9940: Improper Privilege Management
A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker with access to a low-privileged user account to read or write files on the file system of the SiPass integrated server over the network...
CVE-2017-10104: Improper Privilege Management
Vulnerability in the Java Advanced Management Console component of Oracle Java SE subcomponent: Server. The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Java...
CVE-2017-10142: Improper Privilege Management
Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications subcomponent: Mobile Apps. Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...
CVE-2017-7916: Improper Privilege Management
A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be abl...
CVE-2017-11438: Improper Privilege Management
GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...
CVE-2017-11747: Improper Privilege Management
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a...
CVE-2017-11681: Improper Privilege Management
Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php...
CVE-2017-11467: Improper Privilege Management
OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...
CVE-2017-7532: Improper Privilege Management
In Moodle 3.x, course creators are able to change system default settings for courses...
CVE-2017-11361: Improper Privilege Management
Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be "user" or might match the Wi-Fi key...
CVE-2017-1000082: Improper Privilege Management
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...
CVE-2017-1326: Improper Privilege Management
IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060...
CVE-2017-7922: Improper Privilege Management
An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes...
Marathon UI Docker Command Execution
Command execution vulnerability exist in Marathon UI Docker. The vulnerability is due to improper privilege handling. An attacker can exploit the vulnerability to run code with admin permissions...
CVE-2017-4991: Improper Privilege Management
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release uaa-release 13.x versions prior to v13.14...
CVE-2016-8219: Improper Privilege Management
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor role is over-privileged with the ability to restage applications. This could cause application downtime if the restage fails...
CVE-2017-7312: Improper Privilege Management
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...
CVE-2016-0767: Improper Privilege Management
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...