Apache OpenMeetings Security Restriction Vulnerability

Apache OpenMeetings is the United States Apache Apache Software Foundation developed a set of multi-language customizable video conferencing and collaboration system, which supports audio, video and allows users to view each participant's desktop and so on. A security vulnerability exists in Apac...

CVE-2017-7682

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

Authentication flaw

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

PT-2017-8341 · Pulp · Pulp

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue allows remote authenticated users to obtain consumer private keys and escalate privileges. This is due to the world-readable writing of consumer private keys to...

New Relic: Logic flaw enables restricted account to access account license key

Hello - this is a resubmission of my report 197071 that was sent to the public NewRelic program. You have a serious logic flaw which results in a restricted account being able to view the account license key. This is able to be performed by logging into a restricted account, clicking on the...

New Relic: A user with restricted privileges is able to view Phone Number + Billing Email of account owner

Hello - A user with restricted access is able to view the phone number and the billing email of the account owner by simply ".json" at the end of the "https://rpm.newrelic.com/accounts/" URL. The URL structure looks like this: https://rpm.newrelic.com/accounts/██████.json Wherin "███████" is the...

Intel HD Graphics - Unquoted Service Path Privilege Escalation Vulnerability

intel Corp. designs, manufactures and sells computer components and related products. The company also engages in the designing and manufacturing of computing and communication components, such as microprocessors, chipsets, motherboards, and wireless and wired connectivity products. It develops...

Apache Shiro Information Disclosure Vulnerability

Apache Shiro is the United States Apache Apache Software Foundation for the implementation of authentication , authorization , encryption and session management of the Java security framework . An information disclosure vulnerability exists in Apache Shiro versions 1.0.0 through 1.2.4, which stem...

[SECURITY] Fedora 23 Update: sudo-1.8.15-2.fc23

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

How to Publish Windows Explorer.exe with Specific Drives, Folders, or URLs

This article describes how to publish specific drives and folders as it is not recommended to publish Explorer.exe directly. Notes: Microsoft does NOTrecommend running Explorer.exe as a published application because the published Explorer.exe application runs as a separate process with restricted...

CVE-2016-2556

The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows improperly allows access to restricted functionality, which allows local users to gain privileges via unspecified vectors...

openssh: missing sanitisation of input for X11 forwarding

It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with restricted SSH access could possibly use this flaw to bypass intended restrictions...

Cisco ASR 1000 Series Root Shell License Bypass Vulnerability

A vulnerability in the way software packages are loaded in Cisco IOS XE Software for the Cisco Aggregation Services Routers ASR 1000 Series could allow an authenticated, local attacker to gain restricted root shell access. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be...

jre7-openjdk: multiple issues

CVE-2015-4734 information disclosure It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about...

Immunity Canvas: FIREFOX_PDFJS_FILEREADER

Name| firefoxpdfjsfilereader ---|--- CVE| CVE-2015-4495 Exploit Pack| CANVAS Description| firefoxpdfjsfilereader Notes| CVE Name: CVE-2015-4495 VENDOR: Mozilla NOTES: Tested on: Ubuntu 14.04.3 LTS Firefox 39.0 Under the Response tab of ClientD main window, the option "Respond directly with exploi...

abrt: default abrt event scripts lead to information disclosure

It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged use...

Member of confluence-administrators group able to see restricted page in pagetree, quick search and navigation panel

Bug Background Confluence super-users or member of confluence-administrators group should be able to access any content in Confluence including restricted content as long as it have the direct URL to access as describe in our documentation...

CVE-2013-4432

Affected software: Mahara. Vulnerable versions: Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4. Issue: improper access restrictions on folders allows remote authenticated users to read arbitrary folders via (1) an active folder tab loaded before permissions were removed or (2) t...

CVE-2014-3131

SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1...

PT-2014-2384

Name of the Vulnerable Software and Affected Versions Open Solution Quick.Cms version 5.0 Open Solution Quick.Cart version 6.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "admin.php". This could potentially lead ...