CREATE SD official App for Android fails to restrict access permissions

Overview CREATE SD official App for Android provided by CREATE SD CO., LTD. implements the function to access a requested URL using an Intent. This function contains an improper access control vulnerability CWE-284 that may allow the vulnerable App to receive an Intent from an arbitrary App and t...

CVE-2019-6570

A vulnerability has been identified in SINEMA Remote Connect Server All versions V2.0. Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

CVE-2019-1653

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

GitLab Kubernetes integration server-side request forgery vulnerability

GitLab is a suite of open source applications developed with Ruby on Rails that enables a self-hosted Git version control system project repository with Github-like functionality for accessing a project's file contents, commit history, bug lists, etc. The GitLab Kubernetes integration is a versio...

CVE-2018-14593

An issue was discovered in Open Ticket Request System OTRS 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL...

CVE-2018-0384

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly...

CVE-2017-7931

In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator URL on the web server, a malicious user is able to access the configuration files and application pages without authentication...

Apple macOS High Sierra PDFKit Security Bypass Vulnerability

Apple macOS High Sierra is the United States Apple Apple company's set of Mac computers developed specifically for the operating system. PDFKit is one of the PDF document generation components. A security vulnerability exists in the PDFKit component in Apple macOS High Sierra versions prior to...

CVE-2017-1191

An undisclosed vulnerability in CLM applications including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0 with potential for failure to restrict URL Access. IBM X-Force ID: 123661...

CVE-2017-1191

An undisclosed vulnerability in CLM applications including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0 with potential for failure to restrict URL Access. IBM X-Force ID: 123661...

Code injection

An undisclosed vulnerability in CLM applications including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0 with potential for failure to restrict URL Access. IBM X-Force ID: 123661...

CVE-2017-1191

An undisclosed vulnerability in CLM applications including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0 with potential for failure to restrict URL Access. IBM X-Force ID: 123661...

CVE-2017-1191

CVE-2017-1191 is an undisclosed vulnerability in IBM CLM products (CLM suite: RTC, RQM, RRC, and related Rational offerings) described as a potential failure to restrict URL access. The IBM advisory and related IBM Jazz/CLM bulletin enumerate affected versions across CLM 4.x–6.0.x (e.g., CLM 6.0....

Design/Logic Flaw

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...

Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass Vulnerability

Exploit for cgi platform in category web applications Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects:...

Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass

Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases befo...

CVE-2017-14244

The CVE-2017-14244 vulnerability affects the iBall ADSL2+ Home Router FW_iB-LR7011A_1.0.2, enabling an authentication bypass by accessing admin pages through CGI extensions (e.g., /info.cgi, /password.cgi). Root cause: CGI-based authentication bypass that exposes admin settings. Impact: attacker ...

Error: “Cannot start apps. Please run reset receiver to resolve a lockdown conflict for ClientHostedAppsShortcuts (error 2320)”

Users access a StoreURL and launch published IE from their Client machines. Then they use published IE and connect to another StoreURL from another farm to access another application. Majority but not all users get errors while launching the application. Error: “Cannot start apps. Please run Rese...

Stellar.org: Direct URL access to PDF files

hi, I was able to access the following PDF files without any authentication https://www.stellar.org/wp-content/uploads/2014/07/Bylaws-00580045-10.pdf https://www.stellar.org/wp-content/uploads/2014/07/FILED-STELLAR-DEVELOPMENT-FOUNDATION-00594674.pdf the pdf files under path...