DEBIAN-CVE-2020-9543

OpenStack Manila =8.0.0 =9.0.0 9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks...

SUSE-SU-2020:0660-1 Security update for openstack-manila

This update for openstack-manila fixes the following issues: - CVE-2020-9543: Fixed an issue where other project users to view, update, delete, or share resources that do not belong to them, due to a context-free lookup of a UUID bsc1165643...

PT-2020-10034 · Abb · Abb Asset Suite

Name of the Vulnerable Software and Affected Versions: ABB Asset Suite versions 9.0 through 9.3 ABB Asset Suite version 9.4 prior to 9.4.2.6 ABB Asset Suite version 9.5 prior to 9.5.3.2 ABB Asset Suite version 9.6.0 Description: The issue is related to insufficient access control in the web...

USN-4235-1 nginx vulnerability

Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain errorpage configurations. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks and access resources contrary to expectations...

Samsung J7 Duo Access Control Error Vulnerability (CNVD-2020-14674)

Samsung J7 Duo is a smartphone from Samsung South Korea. The Samsung J7 Duo build fingerprint: samsung/j7duolteub/j7duolte:8.0.0/R16NW/J720MUBS3ASB2:user/release-keys in the com.samsung.android. An access control error vulnerability exists in the themecenter app. The vulnerability stems from the...

Haier G8 Access Control Error Vulnerability

Haier G8 is a smartphone from the Chinese company Haier. An access control error vulnerability exists in the Haier G8. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the vulnerability...

Samsung J7 Pro Access Control Error Vulnerability

The Samsung J7 Pro is a smartphone from the South Korean company Samsung Samsung. An access control error vulnerability exists in the Samsung J7 Pro. The vulnerability stems from the network system or product not properly restricting access to resources from unauthorized roles. An attacker could...

Samsung J7 Pro Access Control Error Vulnerability (CNVD-2020-14675)

The Samsung J7 Pro is a smartphone from the South Korean company Samsung Samsung. The Samsung J7 Pro build fingerprint: samsung/j7y17lteub/j7y17lte:8.1.0/M1AJQ/J730GUBS6BSC1:user/release-keys in the com.samsung.android. An access control error vulnerability exists in the themecenter app. The...

PT-2019-4650 · Ibm · Ibm Security Guardium Big Data Intelligence

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Big Data Intelligence version 4.0 Description: The issue is related to the lack of protection for service data in the Security Guardium Big Data Intelligence software. This could allow a remote attacker to gain...

Unspecified vulnerability in cPanel (CNVD-2019-27422)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in cPanel versions prior to 62.0.17. An attacker can exploit the vulnerability to access restrict...

PT-2019-18668 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 6.8.2 Kibana versions prior to 7.2.1 Description: The issue is related to a server side request forgery SSRF flaw in the graphite integration for the Timelion visualizer. An attacker with administrative access could s...

Red Hat libvirt Access Control Error Vulnerability

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. It supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. An access control error vulnerability exists in Red Hat...

CVE-2019-10147

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter are not limited by cgroups during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

CVE-2019-10145

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

CVE-2019-10147

CVE-2019-10147 affects rkt (through version 1.30.0). The issue is that containers started with rkt enter are not isolated by cgroups during stage 2, allowing processes run within those containers to access host resources. The connected documents reiterate that this limitation can enable compromis...

The vulnerability of the SINEMA Remote Connect server’s software lies in insufficient access control checks, allowing attackers to gain access to system resources through certain URL addresses, bypassing the authentication mechanism.

The vulnerability of the SINEMA Remote Connect server software is related to insufficient verification of access rights. Exploiting this vulnerability could allow a malicious actor to gain access to system resources through certain URL addresses, bypassing the authentication mechanism...

Gemalto Ezio Server Access Control Error Vulnerability

Gemalto Ezio Server is an authentication server from Gemalto USA. An access control error vulnerability exists in Gemalto Ezio Server versions prior to 3.1.0, which can be exploited by an attacker to access unauthorized resources...

Improper Access Control

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. The following security issues are addressed with this release: An authorization flaw was discovered in Kubernetes; the API server did not...

CVE-2019-3844

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that wil...

CVE-2019-3843

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...