Insecure Access Control

chromium is uses an insecure access control. An insufficient policy enforcement was found in the Android intents component, allowing an attacker to bypass security restrictions...

Insecure Access Control

github.com/containerd/containerd uses insecure access controls. Pulling of malicious image can cause Unix file permission changes for existing files in the host's file system. This can result in restriction of access to files which should otherwise by accessible...

Insecure Access Control

github.com/pterodactyl/wings allows insecure access to endpoints. An attacker is able to access resources on local networks that would otherwise be inaccessible due to lack of hostname verification...

Emmanuel MyDomoAtHome 安全漏洞

GitLab Emmanuel MyDomoAtHome is a GitLab open source application. A REST interface to ImperoHome with Domoticz ISS. Emmanuel MyDomoAtHome has a security vulnerability that stems from incorrect access control implementation. An unauthenticated, remote attacker could use the vulnerability could...

Insecure Access Controls

@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...

Insecure Access Control

mediawiki uses an insecure access control. A user is able to protect a page to a higher level than they currently have permissions for...

Content Spoofing

chromium is vulnerable to content spoofing. An insecure access control allows an attacker who has compromised the renderer process to spoof contents of the Omnibox via a malicious HTML page...

Insecure Access Control

shinobi uses insecure access controls. An attacker is able to access the User/Admin/Super API functions through the use of JS Proto Method names held in an internal JS Object and trick the System into accepting supplied API Key that exists in the underlying JS object...

CVE-2021-27509

In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code...

Insecure Access Controls

Xen is vulnerable to denial of service. Unprivileged guest users are able to obtain and modify permissions, list and delete root nodes. This is due to permissions that are not properly enforced...

Privilege Escalation

odoo is vulnerable to privilege escalation. Insecure access controls allows remote authenticated users with access to contact management to modify user accounts, resulting in the attacker obtaining higher privileges...

Insecure Access Control

elog does not properly restrict access. A remote attacker is able to post data as any username in the logbook...

Insecure Access Control

oauthenticator uses insecure access control. The deprecated configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been...

Access of Resource Using Incompatible Type ('Type Confusion')

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Information Disclosure

Moodle uses insecure access control. The deprecated configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If...

Insecure Access Controls

awsencryptionsdkcli does correctly enforce strict mode. The application operates in discovery mode even when strict mode is specified, allowing various operations within the package which would otherwise be restricted...

Insecure Access Control

overlayfs uses insecure access control. Insufficient permission checking when copying up files in an overlayfs. An attacker is able to exploit the vulnerability to obtain read access to files on the system. that they would not normally be permitted to access...

Insecure Access Control

github.com/hashicorp uses insecure access controls. Improper scheduling of the batch token expiration time allows the batch token leases to outlive their TTL Time-to-live...

Insecure Access Controls

ibus uses insecure access controls. A local attacker is able to access the input bus of another user and perform keylogging...

CVE-2018-11765

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled...