258 matches found
CVE-2019-16186
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
Insecure Access Controls
nuget package manager uses insecure access controls. An authenticated attacker is able to tamper and modify contents of the intermediate build folder obj...
Insecure Access Controls
postgresql is vulnerable to insecure access controls vulnerability. This is because the pgcatalog.pglogfilerotate function does not follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it and could use this flaw to force log rotation...
Insecure Access Controls
Sonatype Nexus Repository Manager is use an insecure access controls. An unauthenticated user can craft requests in a way that can allow execution of arbitrary code and programs on the host system...
CVE-2019-6266
Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...
CVE-2019-6266
CVE-2019-6266 affects Cordaware bestinformed for Windows prior to version 6.2.1.0. Public sources describe insecure SSL certificate verification and insecure access patterns, which can allow remote attackers to downgrade encrypted connections to cleartext. Related CNVD entries for the same produc...
PT-2019-1405 · Canonical · Snapd +1
Name of the Vulnerable Software and Affected Versions: Canonical snapd versions prior to 2.37.1 Description: The issue is related to insufficient access control in the snapd utility, which can be exploited to elevate privileges using a specially crafted file. This allows an attacker to run...
Arbitrary Code Execution
IBM JDK is vulnerable to arbitrary code execution. An insecure access restriction to the Attach API allows an attacker to connect to the affected resource and execute untrusted native code...
CVE-2018-11883
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, in policy mgr unit test if mode parameter in wlan function is given an out of bound value it can cause an out of bound access while accessing the PCL table...
CVE-2018-9853
Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server...
CVE-2018-9853
CVE-2018-9853 affects freeSSHd version 1.3.1. The root cause is insecure access control that lets an attacker log in to an unprivileged account and escalate to the privileges of the freesshd.exe process. This yields a high to critical impact in practice, as indicated by the CVSS metrics (high con...
CVE-2018-9853
Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server...
bezak.umms.med.umich.edu Improper Access Control vulnerability
Open Bug Bounty ID: OBB-632920 Description| Value ---|--- Affected Website:| bezak.umms.med.umich.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...
sites.lsa.umich.edu Improper Access Control vulnerability
Open Bug Bounty ID: OBB-628086 Description| Value ---|--- Affected Website:| sites.lsa.umich.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Wordpress Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...
Design/Logic Flaw
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...
CVE-2017-5260
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...
CVE-2017-15917
In Paessler PRTG Network Monitor 17.3.33.2830, a read-only user can forge and send a crafted request to the server to create a Map, enabling unintended map creation by non-privileged users. The information confirms the affected product and the faulty operation (Map creation by a read-only user) b...
Gxlcms Arbitrary File Read Vulnerability
Gxlcms is an enterprise website creation system. A security vulnerability exists in Gxlcms that originates from the program using an insecure method to restrict access. The vulnerability can be exploited by a remote attacker to read arbitrary files by sending an 's' parameter with a changed...
