PT-2018-7108

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions 2017.1.x through 2017.2.1 Description: The issue arises when specially formatted strings containing certain formatting characters are used as Classifier node group names or RBAC role display names, causing errors an...

CVE-2017-2296: Improper Input Validation

In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2...

Design/Logic Flaw

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2018-0096

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

Design/Logic Flaw

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2018-0096

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

CVE-2018-0096

Cisco Prime Infrastructure is affected by an RBAC failure that lets an authenticated remote attacker bypass RBAC and modify a virtual domain, viewing and altering configurations across virtual domains. root cause is improper enforcement of RBAC for virtual domains; exploitation requires an authen...

CVE-2018-0092

CVE-2018-0092 affects Cisco NX-OS System Software on Nexus platforms (Nexus 3000/3600/9000 standalone NX-OS and Nexus 9500 R-series line cards/fabric modules). The root cause is insufficient RBAC checks for the network-operator role, allowing an authenticated, local attacker to delete other confi...

CVE-2018-0096

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

CVE-2018-0096

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

PT-2018-8606

Name of the Vulnerable Software and Affected Versions: Cisco Prime Infrastructure affected versions not specified Description: A vulnerability in the role-based access control RBAC functionality could allow an authenticated, remote attacker to perform a privilege escalation. This is due to a...

CVE-2018-0096: Incorrect Authorization

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

Cisco NX-OS System Software Unauthorized User Account Deletion Vulnerability

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

PT-2018-8602

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS System Software affected versions not specified Description: A vulnerability in the network-operator user role implementation could allow an authenticated, local attacker to improperly delete valid user accounts due to a lack of...

Authorization

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

Affected product: ManageIQ / Red Hat CloudForms Management Engine (CFME). Issue: The check_privileges method in vmdb/app/controllers/application_controller.rb allows remote authenticated users to bypass authorization by exploiting improper RBAC checking, specifically related to the rbac_user_edit...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...