Design/Logic Flaw

A vulnerability in role-based access control of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to...

CVE-2020-3329 Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability

A vulnerability in role-based access control of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to...

DEBIAN-CVE-2020-12430

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemudriver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged user...

ALPINE-CVE-2020-12430

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemudriver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged user...

UBUNTU-CVE-2020-12430

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemudriver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged user...

podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first...

CVE-2020-11692

In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators...

Design/Logic Flaw

In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators...

CVE-2020-11692

In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators...

Hackers Update Age-Old Excel 4.0 Macro Attack

Hackers have updated the age-old Excel malware attack technique with a new passwordless twist. Researchers have identified a new method that no longer requires victims to enter a password to open a danger document, more readily exposing them to potential malware infection. Researchers from securi...

CVE-2020-9004

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and...

Authorization

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and...

CVE-2020-9004

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and...

Visma Public: Ability to delete projects from Archived companies (Read only version)

The researcher discovered that Projects can be deleted from Archived companies which have "read only version".It was assessed as Low impact...

Denial Of Service (DoS)

libvirt is vulnerable to denial of service. A flaw was found in the way libvirtd handled error reporting for concurrent connections. A remote attacker able to establish read-only connections to libvirtd on a server could use this flaw to crash libvirtd...

Privilege Escalation

libvirt is vulnerable to privilege escalation. The vulnerability exists as it was found that several libvirt API calls did not honor the read-only permission for connections. A local attacker able to establish a read-only connection to libvirtd on a server could use this flaw to execute commands...

Arbitrary Code Execution

xen is vulnerable to privilege escalation. The vulnerability exists as it was found to allow unprivileged DomU domains to overwrite xenstore values which should only be changeable by the privileged Dom0 domain. An attacker controlling a DomU domain could, potentially, use this flaw to kill...

April 2015 servicing stack update for Windows 8.1 and Windows Server 2012 R2

April 2015 servicing stack update for Windows 8.1 and Windows Server 2012 R2 This article describes a servicing stack update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2. The update fixes some issues. About servicing stack The servicing stack includes the files and resources that a...

CVE-2018-14617

An issue was discovered in the Linux kernel. A NULL pointer dereference and panic in hfspluslookup in the fs/hfsplus/dir.c function can occur when opening a file that is purportedly a hard link in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata...

CVE-2020-1726

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first...