CVE-2021-22368

There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device...

CVE-2021-22368

There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device...

Design/Logic Flaw

There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device...

CVE-2021-22368

Summary of CVE-2021-22368 : A permission control vulnerability exists in Huawei smartphones, caused by a lack of effective permission granting and access control, enabling exploitation that can affect normal device use. Public details in CNNVD indicate affected Huawei devices (e.g., EMUI 10.1.1 a...

CVE-2021-22368

There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device...

CVE-2021-21736

A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory...

CVE-2021-21736

A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory...

Jenkins < 2.263.2 LTS / 2.275 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.275 or is a version of Jenkins LTS prior to 2.263.2. It is, therefore, affected by multiple vulnerabilities, including the following: - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure...

CVE-2018-19418

Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control...

Command injection

Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control...

CVE-2018-19418

CVE-2018-19418 affects Foxit PDF ActiveX/SDK ActiveX prior to 5.5.1. Root cause: lack of security permission control leading to remote code execution via command injection. Exploitation notes vary across sources; SRC-2019-0009 indicates user interaction is required (user must open a malicious fil...

CVE-2018-19418

Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control...

GaussDB Kernel: Controlling the Permission to Execute the SECURITY INVOKER Function

The SECURITY INVOKER function is executed with the permissions of the invoker. Before invoking a function not created by yourself, check the function content to prevent the function creator from performing unauthorized operations with your Permissions. Copyright C 2020 Greenbone Networks GmbH Som...

GaussDB Kernel: Controlling the Permission to Execute the SECURITY DEFINER Function

Because the SECURITY DEFINER function is executed with the privileges of the user that created it, ensure that this function is not misused. For security purposes, set searchpath to exclude any schemas writable by untrusted users. This prevents malicious users from creating objects that mask...

openGauss: Controlling Roles with the WITH GRANT OPTION Permission

Users with the WITH GRANT OPTION permission can grant permissions on objects to other users. For database security purposes, control users having this permission. During permission granting, users with the WITH GRANT OPTION permission specify the objects and users with the WITH ADMIN OPTION...

AZL-6353 CVE-2020-14342 affecting package cifs-utils for versions less than 6.8-6

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

Group - Moderately critical - Information disclosure - SA-CONTRIB-2020-032

The Group module enables you to hand out permissions on a smaller subset, section or community of your website. With the 1.1 security release, new code was introduced to ensure proper access for all entity types, but a mistake introduced unexpected access to unpublished nodes...

GitLab: Stored XSS in markdown when redacting references

Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...

Security Bulletin: Permission Control Security Vulnerability Affects IBM Sterling B2B Integrator (CVE-2019-4042)

Summary IBM Sterling B2B Integrator Standard Edition has addressed the permission control vulnerability. Vulnerability Details CVEID: CVE-2019-4042 DESCRIPTION: IBM Sterling B2B Integrator could allow a user without permission to access EBICS configuration to use its own secure token to access th...

CVE-2019-3425

The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts...