Security feature bypass

A Remote Bypass Security Restriction vulnerability in HPE Network Node Manager i NNMi Software versions v10.0x, v10.1x, v10.2x was found...

CVE-2017-8948

CVE-2017-8948 describes a remote bypass of security restrictions in HP/NNMi (HPE Network Node Manager i) software. Affected are NNMi versions v10.0x, v10.1x, and v10.2x. The CVSS metrics indicate high severity (CVSSv3: 9.8) with unauthenticated network access and no user interaction required; imp...

CVE-2017-8948

A Remote Bypass Security Restriction vulnerability in HPE Network Node Manager i NNMi Software versions v10.0x, v10.1x, v10.2x was found...

CVE-2018-6635

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation RMI restrictions, aka SMGR-26896...

UBUNTU-CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions...

Google Chrome for Mac, Windows and Linux Security Bypass Vulnerability (CNVD-2018-03790)

Google Chrome for Mac, Windows and Linux is a web browser developed by Google, Inc. for the Mac, Windows and Linux platforms. A security vulnerability exists in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac, and Linux platforms, which stems from the program's failure to...

Google Chrome for Mac, Windows and Linux Security Bypass Vulnerability (CNVD-2018-03797)

Google Chrome for Mac, Windows and Linux is a web browser developed by Google, Inc. for the Mac, Windows and Linux platforms. A security vulnerability exists in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac and Linux platforms. A remote attacker can exploit this vulnerability ...

CVE-2017-17876

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

CVE-2017-17433

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

UBUNTU-CVE-2017-17433

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

Cisco Firepower System Software SNORT Detection Engine Security Bypass Vulnerability

Cisco Firepower System Software is a next-generation firewall product NGFW from Cisco.SNORT detection engine is one of the intrusion detection engines. A security vulnerability exists in the SNORT detection engine in Cisco Firepower System Software, which stems from the program's failure to...

Samba Man-in-the-Middle Security Restriction Bypass Vulnerability

Samba is free software that allows UNIX operating systems to link with the SMB/CIFS network protocol of the Microsoft Windows operating system. A security vulnerability exists in Samba that allows remote attackers to exploit the vulnerability to submit special requests, bypass security...

GHSA-P692-7MM3-3FXG actionpack is vulnerable to remote bypass authentication

The httpbasicauthenticatewith method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a...

CVE-2017-7080

An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Security" component. It allows remote attackers to bypass intended certificate-trust restrictions via a...

CVE-2017-5791

The doFilter method in UrlAccessController in HPE Intelligent Management Center iMC PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI...

CVE-2017-5791

The doFilter method in UrlAccessController in HPE Intelligent Management Center iMC PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI...

Authentication flaw

The doFilter method in UrlAccessController in HPE Intelligent Management Center iMC PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI...

CVE-2017-13983

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to bypass authentication...

Code injection

DISPUTED FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session. NOTE: Vendor states that issue does not exist in...

FFmpeg 'mxf_read_primer_pack' function input validation vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A security vulnerability exists in the 'mxfreadprimerpack' function in the libavformat/mxfdec.c file in FFmpeg version 3.3.3. A remote attacker can exploit this vulnerability to bypass...