CVE-2016-5012

In Moodle 3.x, glossary search displays entries without checking user permissions to view them...

CVE-2016-5012

In Moodle 3.x, glossary search displays entries without checking user permissions to view them...

Application Launch Fails Intermittently With Event ID 7

User launches published desktop via Storefront and can see the DesktopViewer. Desktop Viewer closes after a few seconds and logs the following error in the EventLog: Event ID: 1050 Citrix Desktop service connection validation failed on domain "for user" for reason "Deny" followed by Event ID7: "I...

Privilege Escalation

django-jet does not properly check user permissions. It allows users without permission to access modellookupview when using RelatedFieldAjaxListFilter...

CVE-2016-6746

An information disclosure vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission...

Error: "Logon failure: the user has not been granted the requested logon type at this computer."

Under certain circumstances, the Citrix WEM Agent log may show the following message: "Exception - VuemEnvironmentalSettingsController.ExecuteEntityPolicySettings : Logon failure: the user has not been granted the requested logon type at this computer."...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-7078

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned no organizations/locations, they are able to view all resources instead of none mirroring an administrator's view. The user's actions are still limited by their...

DNN (DotNetNuke) < 8.0.4 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is affected by multiple vulnerabilities : - A flaw exists due to improper validation of user permissions. An authenticated, remote attacker with permissions to edit a particular page can exploit this to make changes to sit...

Require Login - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2016-045

This module enables you to restrict site access without using user roles or permissions. The module does not sufficiently escape some of its settings, and, in some cases, allows malicious users to bypass the protection offered by Require Login. CVE identifiers issued ACVE identifier will be...

CVE-2016-3833

The Shell component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not properly manage the MANAGEUSERS and CREATEUSERS permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka internal bug 29189712...

Smiths Medical CADD-Solis Medication Safety Software Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on November 1, 2016, and is being released to the NCCIC/ICS-CERT web site. Smiths Medical has reported two vulnerabilities in Smiths Medical’s CADD-Solis Medication Safety Software that were identified by Andrew...

Web Interface Privilege Escalation

Palo Alto Networks Panorama administrators have the ability to assign predefined permissions to users created on PAN-OS. A read-only user with CLI access could elevate web interface privileges. Ref. 88191...

Multiple cross-site scripting vulnerabilities in phpMyAdmin (CNVD-2016-04309)

phpmyadmin is an online management tool for MySQL databases. A cross-site scripting vulnerability exists in phpmyadmin versions 4.4.x and 4.6.x in the user permissions page and the user group function, which can be exploited by an attacker to execute arbitrary scripts across sites...

libxml2 security update

CentOS Errata and Security Advisory CESA-2016:1292 An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score,...

CVE-2016-2105

An integer overflow flaw, leading to a buffer overflow, was found in the way the EVPEncodeUpdate function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of th...

Default credentials

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details...

CVE-2014-6276

The CVE-2014-6276 entry corresponds to Roundup (web-based issue tracker) and affects versions before 1.5.1. The root cause is that schema.py does not properly restrict attributes in default user permissions, enabling remote authenticated users to view sensitive user details. Observed impact inclu...