Apache Ranger 0.5.x / 0.6.x / 0.7.0 Policy Miss / Permission Check Vulnerability

Apache Ranger versions prior to 0.7.1 suffer from issues where policy evaluation ignores characters after the asterisk wildcard character and the Hive Authorizer fails to check for RWX permission when an external location is specified. Hello: Please find below details on CVEs fixed in Ranger 0.7....

Information Disclosure Due To Permission Checking Bypass

Moodle is vulnerable to information disclosure. The vulnerability exists because it does not correctly perform permission checks on authenticated users when they are editing or viewing questions...

Incorrect permission check for deployment projects (CVE-2017-8907)

Bamboo did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan...

Apple OS X Server Denial of Service And User Enumeration Vulnerabilities

Apple OS X Server is prone to denial of service and user enumeration vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Privilege Escalation

Katello is vulnerable to privilege escalation. The library does not check for permission for the updateroles function, allowing a malicious user to upgrade a user account to administrator level privileges...

Code injection

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to...

Postfix Admin Security Bypass Vulnerability

Postfix Admin is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

DEBIAN-CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

Design/Logic Flaw

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

UBUNTU-CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

CVE-2017-5930

The CVE-2017-5930 issue affects PostfixAdmin's AliasHandler. The AliasHandler component before 3.0.2 permits remote authenticated domain admins to delete protected aliases via delete.php due to a missing permission check, enabling unintended alias deletion. Public sources confirm the fix is to up...

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

Fedora 25 : freeipa (2017-98f85533f0)

Fixed CVE 2017-2590: freeipa: ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands fedora-all Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean a...

Oracle Linux 7 : ipa (ELSA-2017-0388)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0388 advisory. - Resolves: 1413137 CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands - ca: correctly authorise ca-del, ca-enable a...

ipa security and bug fix update

4.4.0-14.0.1.el73.6 - Blank out header-logo.png product-name.png Replace login-screen-logo.png 20362818 4.4.0-14.6 - Resolves: 1416488 replication race condition prevents IPA to install - waitforentry: use only DN as parameter - Wait until HTTPS principal entry is replicated to replica - Use prop...