CVE-2020-11465

An issue was discovered in Deskpro before 2019.8.0. The /api/apps/ endpoints failed to properly validate a user's privilege, allowing an attacker to control/install helpdesk applications and leak current applications' configurations, including applications used as user sources used for...

CVE-2020-11466

CVE-2020-11466 affects Deskpro before 2019.8.0. The /api/tickets endpoint imperfectly validates user privileges, allowing an attacker to retrieve arbitrary information about all tickets and to obtain the ticket authentication code. This can lead to leaking sensitive ticket data and, in some cases...

CVE-2020-0661

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2020-0751...

CVE-2019-16896

In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll aka the backup module improperly validates the administrative privileges of the user, allowing an arbitrary file write via a symbolic link attack with file restoration functionality...

GitLab Information Disclosure Vulnerability (CNVD-2019-30785)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

CVE-2019-1754

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...

Pulse Secure Virtual Traffic Manager Information Disclosure Vulnerability

Pulse Secure Virtual Traffic Manager is a software-based, high-performance application delivery controller from Pulse Secure, USA. A security vulnerability exists in Pulse Secure Virtual Traffic Manager versions 9.9 prior to 9.9r2 and 10.4r1 prior to 10.4r1, which stems from the program failing t...

IBM Campaign Privilege Access Control Vulnerability

IBM Campaign formerly known as Unica Campaign is a management solution from IBM in the United States used to help marketers design, execute, measure, and optimize marketing advertising. A privilege access control vulnerability exists in IBM Campaign versions 9.1.0 and 9.1.2, which stems from the...

Nextcloud Server Privilege Authentication Vulnerability (CNVD-2019-18774)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform.Nextcloud Server is one of the server version. A privilege validation vulnerability exists in versions of Nextcloud Server prior to 14.0.0 that can be exploited by an attacker to bypa...

CloudBees Jenkins Configuration as Code Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task...

Samba Security Bypass Vulnerability (CNVD-2018-07048)

Samba is a freeware implementation of the SMB protocol on Linux and UNIX systems, consisting of a server and a client program. A security bypass vulnerability exists in Samba due to an LDAP server on a Samba Active Directory AD Domain Controller DC that does not properly validate privileges when...

Integrate Your Ticketing System into Database Security to Prevent DBA Privilege Abuse

Many of the recent high-profile data security breaches were made by trusted insiders. They are often database administrators DBAs who are highly privileged and trusted insiders with access to sensitive data. In this blog post, I will discuss the inherent risk introduced by highly privileged...

IBM MaaS360 DTM Information Disclosure Vulnerability

IBM MaaS360 DTM is a suite of enterprise mobile device management solutions from IBM USA. The solution provides end-to-end security and management of mobile devices, documents, applications and email. An information disclosure vulnerability exists in versions of IBM MaaS360 DTM prior to 3.81, whi...

Security Advisory - Information Disclosure Vulnerability in AEE extension of MTK Platform

There is an information disclosure vulnerability in AEE extension of MTK Platform used in Huawei smart phones. Due to improper privilege validation on specific processes, an attacker who tricks a user into installing a malicious application on the smart phone can exploit this vulnerability to...

PostgreSQL Information Disclosure Vulnerability (CNVD-2017-06930)

PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. An information disclosure vulnerability exists in the...

Microsoft Browser Elevation of Privilege Vulnerability

Microsoft Edge is a web browser developed by Microsoft USA and is the default browser that comes with the Windows 10 operating system. Elevation of privilege vulnerability in Microsoft Edge, which stems from the program not properly validating privileges under certain conditions. An attacker coul...

CVE-2014-2127

Cisco Adaptive Security Appliance ASA Software 8.x before 8.25.48, 8.3 before 8.32.40, 8.4 before 8.47.9, 8.6 before 8.61.13, 9.0 before 9.04.1, and 9.1 before 9.14.3 does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows...

CVE-2014-2127

Cisco Adaptive Security Appliance ASA Software 8.x before 8.25.48, 8.3 before 8.32.40, 8.4 before 8.47.9, 8.6 before 8.61.13, 9.0 before 9.04.1, and 9.1 before 9.14.3 does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows...

FreeBSD Security Advisory FreeBSD-SA-13:08.nfsserver

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:08.nfsserver Security Advisory The FreeBSD Project Topic: Incorrect privilege validation in the NFS server Category: core Module: nfsserver Announced: 2013-07-...

FreeBSD-SA-13:08.nfsserver

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:08.nfsserver Security Advisory The FreeBSD Project Topic: Incorrect privilege validation in the NFS server Category: core Module: nfsserver Announced:...