CVE-2017-18584

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action...

Disclosure of issue key validity & issue attachment names in the render api resource - CVE-2019-14995

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check...

Missing permission check in several worklog rest resources - CVE-2019-8445

Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check...

CVE-2019-2023

In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app to add or replace a HAL service with its own service, gaining code execution in a privileged process.Product: AndroidVersions: Android-8....

Code injection

In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app to add or replace a HAL service with its own service, gaining code execution in a privileged process.Product: AndroidVersions: Android-8....

CVE-2019-2023

In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app to add or replace a HAL service with its own service, gaining code execution in a privileged process.Product: AndroidVersions: Android-8....

CVE-2019-2090

In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could lead to local escalation of privilege, with no additional permissions required. User interaction is not needed for exploitation. Product: Android...

Jenkins Artifactory Plugin fillCredentialsIdItems information disclosure vulnerability

Summary An exploitable information disclosure vulnerability exists in the fillCredentialsIdItems endpoint of the Jenkins Artifactory Plugin 3.2.0 and 3.2.1. As a result of this vulnerability a crafted HTTP request from a user with Overall/Read permissions - such as an anonymous user, if enabled -...

EulerOS Virtualization for ARM 64 3.0.2.0 : libvirt (EulerOS-SA-2019-1634)

According to the version of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke...

Information Disclosure

jenkins is vulnerable to information disclosure. The vulnerability exists as remotely authenticated users, with read access, can obtain sensitive plugin installation information due to a missing permissions check in the XML/JSON API endpoints...

CVE-2019-3886

CVE-2019-3886 affects libvirt 4.8.0 and later. The issue is an incorrect permissions check that lets a read‑only/client using APIs depending on the guest agent perform actions that can lead to information disclosure or denial of service (libvirt could block). The connected documents confirm libvi...

CVE-2019-3886

An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block...

PT-2019-16742 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5 Moodle versions prior to 3.4.8 Description: A vulnerability was found where permissions were not correctly checked before loading event information into the calendar's edit event...

User Deletion Via Incorrect Permissions Check

keycloak-services is vulnerable to user deletion through an incorrect permissions check. A malicious user that has access to a service account can delete users in a seperate realm...

Huawei Mate10 FRP Bypass Vulnerability

Huawei Mate10 is a smartphone product. Huawei Mate10 suffers from FRP bypass vulnerability. Due to the system's failure to adequately check permissions, an attacker using a data cable to connect the phone to a computer can bypass the phone's FRP protection and enter the system settings page after...

openSUSE Security Update : the Linux Kernel (openSUSE-2018-886) (Foreshadow)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-10853: A flaw was found in KVM in which certain instructions such as sgdt/sidt call segmentedwritestd doesn't propagate access correctly. As such, during userspa...

CVE-2014-1889

The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check...

Information disclosure

The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check...

CVE-2014-1889

The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check...

CVE-2014-1889

The CVE-2014-1889 entry concerns the BuddyPress WordPress plugin prior to version 1.9.2. The vulnerability arises in the Group creation process, where a missing permissions check allows remote authenticated users to gain control of arbitrary groups (e.g., changing name, description, avatar, and s...