CVE-2017-8447

Summary: CVE-2017-8447 affects Elastic Stack’s X-Pack Security. A bug in the privilege enforcement (versions 5.3.0–5.5.2) can let a user with either ‘delete’ or ‘index’ permissions issue both delete and index requests against the same index. This could enable unintended modification/permission re...

CVE-2017-8447

An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster, they may be able to issue both delete and index requests against that index...

OrientDB Arbitrary Command Execution Vulnerability

OrientDB is a British company Orient a set of open source NoSQL database management system . The system supports ACID transactions , fast indexes and SQL queries and other features . OrientDB 2.22 and previous versions of a security vulnerability , the vulnerability stems from the program fails t...

PostgreSQL -- multiple privilege issues

PostgreSQL Project reports: This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN...

ESA-2011-018: Domain administration privilege enforcement bypass in EMC Avamar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-018: Domain administration privilege enforcement bypass in EMC Avamar. EMC Identifier: ESA-2011-018 CVE Identifier: CVE-2011-1740 Severity Rating: CVSS v2 Base Score: 7.9 AV:A/AC:M/Au:N/C:C/I:C/A:C Affected products: EMC Avamar version 4.x EM...

CVE-2011-1402

Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a reque...

Design/Logic Flaw

Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a reque...

CVE-2011-1402

Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a reque...

CVE-2011-1402

Mahara prior to 1.3.6 is affected by CVE-2011-1402 (and related CVEs). The issue stems from incorrect privilege enforcement, a missing user-id check, and improper handling of the Overriding Start/Stop Dates setting, allowing remote authenticated users to bypass restrictions and perform actions ac...

Mozilla Firefox Chrome Page Loading Restriction Bypass (CVE-2005-2706)

The Firefox and Mozilla web browsers are applications designed for tasks related to browsing the web, such as displaying HTML encoded pages, downloading files, and so on. The web browser implements security restrictions on the execution of scripts and access to certain resources based on the orig...

CVE-2009-1078

Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the expected privilege requirements for 1 deleting audit policies and 2 modifying workflows, which allows remote authenticated users to have an unspecified impact...

CVE-2008-6109

The CVE-2008-6109 issue affects the Robin Rawson-Tetley Animal Shelter Manager (ASM) prior to version 2.2.2, where user privileges are not properly enforced. This enables local users to bypass access restrictions by (a) opening unspecified screens related to the so‑called “double click selector b...