CVE-2021-37132

The CVE-2021-37132 issue affects Huawei HarmonyOS: PackageManagerService contains a Permissions, Privileges, and Access Controls vulnerability that allows third‑party apps to obtain the complete list of Harmony apps without permission. This is triggered by improper access controls in the service,...

Improper Access Control in microweber/microweber

Description Access Controls are used in an application to restrict a user to access only intended functions. If the user is able to access any feature/function which is not allowed by the application and user gets successful in this attempt, then it will be considered as broken access control...

CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN...

CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN...

CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN...

CVE-2021-20149

Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default...

CVE-2021-20149

Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default...

CVE-2021-44466

CVE-2021-44466 affects Bitmask Riseup VPN version 0.21.6. The vulnerability is a local privilege escalation caused by improper access controls: when installed outside the system root, the installer fails to set ACLs, allowing a lower-privileged user to replace the VPN executable. When a higher-pr...

CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN...

CVE-2021-20149

Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default...

CVE-2021-20149

CVE-2021-20149 affects Trendnet AC2600 TEW-827DRU (firmware 2.08B01). Connected sources describe insufficient access controls on the WAN interface, with IPv6 access enabled by default while the default IPv4-only iptables ruleset does not govern IPv6. The consequence is that all services on the de...

The vulnerability of the Content Security Policy mechanism implemented in Google Chrome allows a violator to circumvent existing access restrictions policies.

The vulnerability of the Content Security Policy mechanism implemented by Google Chrome is related to authentication errors. Exploiting this vulnerability can allow a remote attacker to circumvent existing access control policies...

CVE-2021-23175

NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial...

CVE-2021-23175

NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial...

CVE-2021-38900

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607...

CVE-2021-38900

CVE-2021-38900 affects IBM BPM 8.5/8.6 and IBM BAW 18.0–21.0, where improper access controls could allow a privileged user to obtain highly sensitive information. Public sources (IBM Security Bulletin, IBM support pages, and related advisories) detail affected product versions within IBM Cloud Pa...

CVE-2021-38900

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607...

Unspecified Vulnerability in IBM Business Automation Workflow (CNVD-2021-102796)

IBM Business Automation Workflow is a suite of workflow automation solutions from IBM USA. The product is mainly used for workflow management, compliance management, and features workflow visibility and scalability. A security vulnerability exists in IBM Business Automation Workflow that stems fr...

Stormshield Endpoint Security 安全漏洞

Stormshield Endpoint Security is a product line of enhanced workstation and server security from the French company Stormshield. A security vulnerability exists in Stormshield Endpoint Security that stems from incorrect access controls configured in Stormshield's previous x...

Security Bulletin: vulnerability affect IBM Cloud Pak for Business Automation Workflow Process Service (CVE-2021-38900)

Summary IBM Cloud Pak for Business Automaion Workflow Process Service could allow a privileged user to obtain highly sensitive information due to improper access controls. Vulnerability Details CVEID: CVE-2021-38900 DESCRIPTION: IBM Business Automation Workflow could allow a privileged user to...