Insecure Access Control

oauthenticator uses insecure access control. The deprecated configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been...

Access of Resource Using Incompatible Type ('Type Confusion')

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Information Disclosure

Moodle uses insecure access control. The deprecated configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If...

Insecure Access Controls

awsencryptionsdkcli does correctly enforce strict mode. The application operates in discovery mode even when strict mode is specified, allowing various operations within the package which would otherwise be restricted...

Insecure Access Control

overlayfs uses insecure access control. Insufficient permission checking when copying up files in an overlayfs. An attacker is able to exploit the vulnerability to obtain read access to files on the system. that they would not normally be permitted to access...

Insecure Access Control

github.com/hashicorp uses insecure access controls. Improper scheduling of the batch token expiration time allows the batch token leases to outlive their TTL Time-to-live...

Insecure Access Controls

ibus uses insecure access controls. A local attacker is able to access the input bus of another user and perform keylogging...

CVE-2018-11765

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled...

CVE-2020-13291

In GitLab before 13.2.3, project sharing could temporarily allow too permissive access...

Insecure Access Control

istio is vulnerable to insecure access control due to incorrect translation of DENY policy for TCP service...

Insecure Access Control

github.com/hashicorp/consul uses an insecure access control. The changes to legacy ACL tokens rules are not enforced as they are not being propagated to the secondary data center...

webERP 4.15.1 - Unauthenticated Backup File Access

Exploit Title: webERP 4.15.1 - Unauthenticated Backup File Access Date: 2020-05-01 Author: Besim ALTINOK Vendor Homepage: http://www.weberp.org Software Link: https://sourceforge.net/projects/web-erp/ Version: v4.15.1 Tested on: Xampp Credit: İsmail BOZKURT...

CVE-2020-8791

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary...

CVE-2020-11968

In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...

solidflux.nl Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1136536 Security Researcher keritzy Helped patch 2027 vulnerabilities Received 5 Coordinated Disclosure badges Received 4 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting solidflux.nl website and it...

Avast Secure Browser Local Elevation of Privilege Vulnerability

Avast Secure Browser is a new browser built for privacy. A security vulnerability exists in Avast Secure Browser version 76.0.1659.101 that stems from an insecure ACL set by the AvastBrowserUpdate.exe file. The vulnerability can be exploited by creating a hard link named Update.ini in the...

Design/Logic Flaw

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

PT-2020-9879 · Avast · Avast Secure Browser

Name of the Vulnerable Software and Affected Versions: Avast Secure Browser version 76.0.1659.101 Description: A Local Privilege Escalation issue was discovered due to an insecure ACL set by the AvastBrowserUpdate.exe when AvastSecureBrowser.exe checks for new updates. The elevated process cleans...

PT-2020-1416 · Oracle · X-Window-System +1

Name of the Vulnerable Software and Affected Versions: Oracle Solaris versions 10 and 11 Description: The issue is related to inadequate access control in the X Window System component of Oracle Solaris. It allows an attacker with low privileges and logon access to the infrastructure to compromis...

Design/Logic Flaw

OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks...