Design/Logic Flaw

An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of...

CVE-2019-9010

The CVE-2019-9010 issue affects 3S-Smart CODESYS V3 products containing the CmpGateway component, across versions prior to 3.5.14.20 (e.g., BeagleBone, emPC-A/iMX6, IOT2000, Linux, PFC100/200, Raspberry Pi, V3 Runtime Toolkit, Gateway V3, and V3 Development System). Root cause: the CODESYS Gatewa...

Zomato: IDOR to delete images from other stores

Summary: The parameter photoids in below request is vulnerable to IDOR /php/clientmanagehandler?██████████&case=remove-active-photo Description: Since there is no check for resid or ownership I was able to delete Gerben's image by just using the photoid from his store. This is a problem because i...

CVE-2017-11364

The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs...

[20170704] - Core - Installer: Lack of Ownership Verification

The CMS installer application lacked a process to verify the users ownership of a webspace, potentially allowing users to gain control...

The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean

Recently, I found that Digital Ocean suffered from a security vulnerability in their domain import system which allowed for the takeover of 20K domain names. If you haven’t given that post a read I recommend doing so before going through this write up. Originally I had assumed that this issue was...

CVE-2016-1773

The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via unspecified vectors...

CVE-2016-1773: Undefined Security Weakness

The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via unspecified vectors...

CVE-2005-3268

yiff server yiff-server 2.14.2 on Debian GNU/Linux runs as root and does not properly verify ownership of files that it opens, which allows local users to read arbitrary files...

CVE-2005-3268

yiff server yiff-server 2.14.2 on Debian GNU/Linux runs as root and does not properly verify ownership of files that it opens, which allows local users to read arbitrary files...

CVE-2005-3268

CVE-2005-3268 concerns yiff server (yiff-server) 2.14.2 on Debian GNU/Linux. The vulnerability arises because the process runs as root and does not properly verify ownership of files it opens, enabling local users to read arbitrary files. The connected documents confirm the affected product/versi...

[SA13201] PunBB Private Message System Module Two Vulnerabilities

TITLE: PunBB Private Message System Module Two Vulnerabilities SECUNIA ADVISORY ID: SA13201 VERIFY ADVISORY: http://secunia.com/advisories/13201/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: Private Message System modul...