PT-2020-1416 · Oracle · X-Window-System +1

Name of the Vulnerable Software and Affected Versions: Oracle Solaris versions 10 and 11 Description: The issue is related to inadequate access control in the X Window System component of Oracle Solaris. It allows an attacker with low privileges and logon access to the infrastructure to compromis...

Design/Logic Flaw

OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks...

nidv.eu Improper Access Control vulnerability

Security Researcher geeknik Helped patch 8525 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting nidv.eu website and its users. Following coordinated and...

CVE-2019-13355

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows local attackers to hijack dotnetproxy.exe, which leads to privilege escalation when the ccSchedulerSVC service runs the executable...

CVE-2019-13355

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows local attackers to hijack dotnetproxy.exe, which leads to privilege escalation when the ccSchedulerSVC service runs the executable...

CVE-2019-13356

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows local attackers to hijack bdcore.dll, which leads to privilege escalation when the AMRT service loads the DLL...

CVE-2019-13355

In Total Defense Anti-virus 9.0.0.773, an insecure access control weakness on the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows a local attacker to hijack dotnetproxy.exe, enabling privilege escalation when the ccSchedulerSVC service executes the file. The...

CVE-2019-13355

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows local attackers to hijack dotnetproxy.exe, which leads to privilege escalation when the ccSchedulerSVC service runs the executable...

CVE-2019-13356

In Total Defense Anti-virus 9.0.0.773, an insecure access-control issue in the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows a local attacker to hijack bdcore.dll and escalate privileges when the AMRT service loads the DLL. The core issue is improper ac...

Information disclosure

On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product...

CVE-2016-11007

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...

CVE-2018-9853

Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server...

CVE-2018-9853

CVE-2018-9853 affects freeSSHd version 1.3.1. The root cause is insecure access control that lets an attacker log in to an unprivileged account and escalate to the privileges of the freesshd.exe process. This yields a high to critical impact in practice, as indicated by the CVSS metrics (high con...

CVE-2018-9853

Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server...

bezak.umms.med.umich.edu Improper Access Control vulnerability

Open Bug Bounty ID: OBB-632920 Description| Value ---|--- Affected Website:| bezak.umms.med.umich.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

sites.lsa.umich.edu Improper Access Control vulnerability

Open Bug Bounty ID: OBB-628086 Description| Value ---|--- Affected Website:| sites.lsa.umich.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Wordpress Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Multiple Remote Vulnerabilities in Apache HBase

Apache HBase is a database for online services with native support for Hadoop, making it an obvious choice for applications that base their data processing on the scalability and flexibility of Hadoop. HBase versions 0.98.0 - 0.98.12, 1.0.0 - 1.0.1, and 1.1.0 have logic errors that can be handled...

McAfee Email Gateway systemWebAdminConfig.do不安全访问控制漏洞

BUGTRAQ ID: 40255 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 McAfee Email Gateway的systemWebAdminConfig.do配置文件没有执行正确的权限检查，拥有只读权限的Web Access用户可以通过在服务器响应的Form字段中添加HTML代码或发送特制POST请求执行写权限操作。 0 McAfee Email Gateway 6.7.1 厂商补丁： McAfee ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

PT-2006-2389 · Trend Micro · Trend Micro Interscan Messaging Security Suite

Name of the Vulnerable Software and Affected Versions: Trend Micro InterScan Messaging Security Suite versions prior to 5.7.0.1121 Description: The issue concerns the ISNTSmtp directory in Trend Micro InterScan Messaging Security Suite, which uses insecure DACLs for critical files. This allows...

CVE-2003-1213

The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb...