Cross site request forgery (csrf)

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles...

CVE-2019-7874

CVE-2019-7874 affects Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7874

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles...

Sql injection

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...

Yoast SEO 1.2.0-11.5 - Authenticated Stored XSS

The vendor's description, reference included below: "Yoast SEO 11.6 also fixes a security issue regarding term pages in WordPress. Unfiltered code was allowed in some fields. This, however, does not pose a problem for single user sites. In specific cases, on multisite installs, this might become ...

Design/Logic Flaw

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions...

PRODSECBUG-2222: Deletion of user roles via cross-site request forgery (CSRF)

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...

CVE-2019-6581

A vulnerability has been identified in Siveillance VMS 2017 R2 All versions V11.2a, Siveillance VMS 2018 R1 All versions V12.1a, Siveillance VMS 2018 R2 All versions V12.2a, Siveillance VMS 2018 R3 All versions V12.3a, Siveillance VMS 2019 R1 All versions V13.1a. An attacker with network access t...

CVE-2019-6581

A vulnerability has been identified in Siveillance VMS 2017 R2 All versions V11.2a, Siveillance VMS 2018 R1 All versions V12.1a, Siveillance VMS 2018 R2 All versions V12.2a, Siveillance VMS 2018 R3 All versions V12.3a, Siveillance VMS 2019 R1 All versions V13.1a. An attacker with network access t...

CVE-2019-6581

A vulnerability has been identified in Siveillance VMS 2017 R2 All versions V11.2a, Siveillance VMS 2018 R1 All versions V12.1a, Siveillance VMS 2018 R2 All versions V12.2a, Siveillance VMS 2018 R3 All versions V12.3a, Siveillance VMS 2019 R1 All versions V13.1a. An attacker with network access t...

Siemens Siveillance VMS Security Bypass Vulnerability

Siemens Siveillance VMS is a set of surveillance video management software from Siemens Germany. A security vulnerability exists in Siemens Siveillance VMS. An attacker could exploit the vulnerability to change user roles...

Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role. This...

CVE-2019-11632

The CVE-2019-11632 issue affects Octopus Deploy versions 2019.1.0–2019.3.1 and 2019.4.0–2019.4.5. An authenticated user who has VariableViewUnscoped or VariableEditUnscoped permissions scoped to a single project can view or edit unscoped variables from a different project. This is tied to the way...

CVE-2018-15459 Cisco Identity Services Engine Privilege Escalation Vulnerability

A vulnerability in the administrative web interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could explo...

CVE-2018-15459 Cisco Identity Services Engine Privilege Escalation Vulnerability

A vulnerability in the administrative web interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could explo...

Authorization Bypass

cumin is vulnerable to authorization bypass. User roles in the application are not properly enforced, allowing unprivileged user to access restricted resources. This allows a remote authenticated attacker to exploit the vulnerability to obtain confidential information and perform unauthorized...

Support Partners Case Management

Challenge A new feature on the ProPartner Portal allows all registered users of a ProPartner's organization to submit and manage Veeam support tickets on behalf of that ProPartner's customers. Previously, the Case Administrator feature only allowed specific employees at a ProPartner organization...

CVE-2018-1928

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119...

CVE-2018-1928

CVE-2018-1928 affects IBM StoredIQ 7.6.0. The issue is improper authorization of user roles, allowing a low-privileged user to access endpoints and perform state-changing actions intended for high-privileged users. The vulnerability’s impact is described in IBM and CVE records, with CVSS v3.0 vec...

Security Bulletin: IBM StoredIQ Privilege Insufficient Authorization

Summary IBM StoredIQ has addressed the vulnerability of not implementing proper authorization of user roles. Vulnerability Details CVEID: CVE-2018-1928 DESCRIPTION: IBM StoredIQ does not implement proper authorization of user roles due to which it was possible for a low privileged user to access...