931 matches found
CFME: check_privileges logic error resulting in privilege escalation
The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...
Administrator role has access to restricted pages
Setting up e.g. a personal space and giving only the owner full access, anonymous access denied, some people administrators? still have access can view, change permission and add comments. This is regardless of space or site restriction. We are using the build-in security systems shared with JIRA...
openstack-nova: RBAC policy not properly enforced in Nova EC2 API
It was found that RBAC policies were not enforced in certain methods of the OpenStack Compute EC2 Amazon Elastic Compute Cloud API. A remote attacker could use this flaw to escalate their privileges beyond the user group they were originally restricted to. Note that only certain setups using...
Oracle Solaris Critical Patch Update : jan2014_SRU11_1_13_6_0
This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: Name Service Cache Daemon NSCD. Supported versions that are affected are 10 and 11.1. Easily exploitable...
DEBIAN-CVE-2014-0167
The Nova EC2 API security group implementation in OpenStack Compute Nova 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for 1 addrules, 2 removerules, 3 destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows...
Design/Logic Flaw
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control RBAC restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing...
CVE-2013-4661
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control RBAC restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing...
CVE-2013-5875
Unspecified vulnerability in Oracle Solaris 11.1 allows local users to affect integrity and availability via vectors related to Role Based Access Control RBAC...
CVE-2013-5875
Unspecified vulnerability in Oracle Solaris 11.1 allows local users to affect integrity and availability via vectors related to Role Based Access Control RBAC...
CVE-2014-0657
The administration portal in Cisco Unified Communications Manager Unified CM 9.11 and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540...
CVE-2014-0657
CVE-2014-0657 affects Cisco Unified Communications Manager (Unified CM) administration portal (9.1(1) and earlier). The issue is insufficient role restriction processing, allowing a remote, authenticated attacker to bypass role-based access by revisiting a previously denied portal URL, potentiall...
CVE-2013-5096
Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804...
Design/Logic Flaw
Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804...
CVE-2013-5096
Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804...
SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting
CVE: CVE-2012-2075 This module stores in the database all messages submitted through the core contact forms, and provides a way to respond to these messages through the website. The module doesn't sufficiently filter user supplied text, leading to a cross-site scripting XSS vulnerability. This...
[SECURITY] Fedora 14 Update: policycoreutils-2.0.85-19.fc14
Security-enhanced Linux is a feature of the Linux=C2=AE kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve the security o...
HP-UX Update for Role-Based Access Control (RBAC) HPSBUX02457
Check for the Version of Role-Based Access Control RBAC OpenVAS Vulnerability Test HP-UX Update for Role-Based Access Control RBAC HPSBUX02457 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...
HP-UX Update for Role-Based Access Control (RBAC) HPSBUX02457
Check for the Version of Role-Based Access Control RBAC OpenVAS Vulnerability Test HP-UX Update for Role-Based Access Control RBAC HPSBUX02457 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...
Design/Logic Flaw
Unspecified vulnerability in Role-Based Access Control RBAC in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access restrictions via unknown vectors...
