CVE-2014-0204: Improper Privilege Management

OpenStack Identity Keystone before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID...

Localize: Assigning a non-existing role to user causes exception when opening project page

Reproduction: - Create a new private project - Log in as another user and go the the newly create project page. Request access there. - Switch back to original user and check pending requests. - At this point I was able to assign a non-existing role I changed the dropdown list and chose 10 as...

Microweber CMS 0.93 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC...

Claroline e-Learning 1.8.1 Privilege Escalation Vulnerability

Due to insufficient permission checking in profile.php any user can assign hem or her self to any organization by issueing a single http request. Claroline users can assign themselves their platform role, leading to possible privilege escalation Description: Due to insufficient permission checkin...

Design/Logic Flaw

The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...

CVE-2013-2113: Undefined Security Weakness

The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...

Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation

Spree contains a flaw that leads to unauthorized privileges being gained. The issue is triggered as certain input related to mass role assignment in app/models/spree/user.rb is not properly verified before being used to update a user. This may allow a remote attacker to assign arbitrary roles and...

Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation

Spree contains a flaw that leads to unauthorized privileges being gained. The issue is triggered as certain input related to mass role assignment in app/models/spree/user.rb is not properly verified before being used to update a user. This may allow a remote attacker to assign arbitrary roles and...

CVE-2011-4295

The moodleenrolexternal:roleassign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment...

Authorization

The moodleenrolexternal:roleassign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment...

CVE-2011-4295

The moodleenrolexternal:roleassign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment...

PT-2012-1843 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.3 Moodle versions 2.1.x through 2.1.0 Description: The issue concerns a lack of authorization check in the moodle enrol external:role assign function, allowing remote authenticated users to gain privileges by...

SA-CONTRIB-2010-045 - Auto Assign Role - Access bypass

The Auto Assign Role serves three primary purposes. The first is to provide an automatic assignment of roles when a new account is created. The second is to allow the end user the option of choosing their own role or roles when they create their account. The third is to provide paths that will...

CVE-2005-2631

Concretely, CVE-2005-2631 affects Cisco Clean Access (CCA) versions 3.3.0–3.3.9, 3.4.0–3.4.5, and 3.5.0–3.5.3. The root cause is improper authentication when invoking API methods, potentially allowing remote attackers to bypass security checks, change a user’s assigned role, or disconnect users. ...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express versions 7.0–SP5 and 8.1–SP2 are affected. When editing weblogic.xml via WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, the process can inadvertently remove security-role-assignment tags if weblogic.xml lacks a principal-name tag, potent...

CVE-2004-0470: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...