postgresql: SET ROLE without ADMIN OPTION allows adding and removing group members

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command...

CVE-2012-5481

Summary: CVE-2012-5481 affects Moodle 2.3.x before 2.3.3. An authenticated remote user can bypass the moodle/role:manage capability on the Check Permissions page and read all capability data, causing information disclosure. Affected product/versions: Moodle 2.3.x prior to 2.3.3. Root cause (as re...

CVE-2012-5481

Moodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage capability requirement and read all capability data by visiting the Check Permissions page...

IBM-Sun deal could alter identity management landscape

The rumored acquisition of Sun Microsystems by IBM could have far-reaching consequences for the identity-management market. Both companies have long histories in the IAM market, but have taken different paths over the years, with Sun focusing on open-source development and IBM sticking with the...

CVE-2007-0423: Undefined Security Weakness

BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which causes other role entitlements to be "inadvertently affected," which has an unknown impact...