PT-2020-2531 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition...

PT-2020-2537

Name of the Vulnerable Software and Affected Versions Java SE versions 7u251, 8u241, 11.0.6, and 14 Java SE Embedded version 8u241 Description The issue is related to insufficient access control in the Libraries component of Java SE and Java SE Embedded, allowing an unauthenticated attacker with...

PT-2020-2027

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to the fixed version Description The issue is related to insufficient access control in the VMware Directory Service vmdir of VMware vCenter Server. This can allow a remote attacker to elevate their...

LY Corporation: Spring Actuator endpoints publicly available and broken authentication

Due to insufficient access control, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. @kazan71p identified two highly sensitive applications leaking information through these endpoints. The LINE Security team shutdown the secondary endpoints just as it was discovere...

CVE-2020-9756

Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050 and 0x80102054 allows a local user with low privileges to read/write 1/2/4 bytes from or to an IO port. This could be leveraged in a number of ways to ultimately run code with...

CVE-2019-18998

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...

CVE-2019-18998

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...

: Viper RGB Driver Multiple Vulnerabilities

1. Advisory Information Title : Viper RGB Driver Multiple Vulnerabilities Advisory ID : CORE-2020-0001 Advisory URL : https://www.coresecurity.com/core-labs/advisories/viper-rgb-driver-multiple-vulnerabilities Date published : 2020-02-17 Date of last update : 2020-02-14 Vendors contacted : Patrio...

PT-2020-10034 · Abb · Abb Asset Suite

Name of the Vulnerable Software and Affected Versions: ABB Asset Suite versions 9.0 through 9.3 ABB Asset Suite version 9.4 prior to 9.4.2.6 ABB Asset Suite version 9.5 prior to 9.5.3.2 ABB Asset Suite version 9.6.0 Description: The issue is related to insufficient access control in the web...

PT-2020-1528 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.1.3.0.0 Description: The issue is related to insufficient access control in the Application Container - JavaEE component of Oracle WebLogic Server, allowing an unauthenticated attacker wit...

PT-2020-1524 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing a high-privileged attacker with logon access to the...

PT-2020-1476

Name of the Vulnerable Software and Affected Versions Java SE versions 7u241, 8u231, 11.0.5, and 13.0.1 Java SE Embedded version 8u231 Description The issue is related to insufficient access control in the Serialization component of Oracle Java SE and Java SE Embedded. It can be exploited by an...

PT-2020-1523

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 Description The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via th...

PT-2020-1525 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server version 10.3.6.0.0 Description: The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing a high-privileged attacker with network access via HTTP to compromise th...

PT-2020-1515 · Oracle · Siebel Ui Framework

Name of the Vulnerable Software and Affected Versions: Oracle Siebel CRM Siebel UI Framework versions 19.10 and prior Description: The issue is related to insufficient access control in the EAI component of the Siebel UI Framework. It allows an unauthenticated attacker with network access via HTT...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0266)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities: - The bnepsockioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a...

CVE-2019-11147

CVE-2019-11147 involvesInsufficient access control in the Intel CSME hardware abstraction driver (MEInfo) and related TXE/Detection Tool components, potentially allowing an authenticated user to escalate privileges via local access. Red Hat and CVE records describe the same issue and list affecte...

Cisco Webex Network Recording Admin Page Privilege Escalation Vulnerability (cisco-sa-20191106-wbs-privilege)

According to its self-reported version, Cisco Webex Meetings is prior to 39.7.0. It is, therefore, affected by a privilege escalation vulnerability in its Network Recording Admin page due to insufficient access control validation. An authenticated, remote attacker could exploit this, by issuing...

EulerOS 2.0 SP8 : kernel (EulerOS-SA-2019-2283)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A memory leak in the af9005identifystate function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to...

Intel Ethernet 700 Series Controllers Insufficient Access Control Vulnerability

Intel Ethernet 700 Series Controllers are network adapter products from Intel. An Insufficient Access Control vulnerability exists in Intel Ethernet 700 Series Controllers firmware prior to version 7.0. An attacker could exploit this vulnerability to cause a denial of service...