Insecure Access Controls

solr-core uses insecure access controls. When using ConfigurableInternodeAuthHadoopPlugin for authentication, requests using server credentials instead of original client credentials would forward/proxy distributed. This would result in incorrect authorization resolution on the receiving hosts...

Security Bulletin: IBM InfoSphere Information Server has a network layer security vulnerability

Summary A network layer security vulnerability in InfoSphere Information Server can lead to privilege escalation or unauthorized access. An unauthorized user could intercept and view communication between client and server. They could also modify or replay certain DataStage commands to get...

A Quick Look Into Cloud Infrastructure Entitlement Management (CIEM)

The cloud security solutions market is growing rapidly, and there are many types of solutions to support your specific business needs. But figuring out the right tool—let alone the right type of tool—can be difficult. Gartner has five security archetypes that fall under the broader cloud security...

ClusterLabs Hawk 安全漏洞

ClusterLabs Hawk is a ClusterLabs open source application. It is used to manage and monitor Pacemaker HA clusters. ClusterLabs Hawk has a security vulnerability that allows an attacker to bypass access restrictions to read or modify data using chmod...

Elasticsearch 信息泄露漏洞

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing, and supports data indexing using JSON over HTTP. Elasticsearch There is an information disclosure vulnerability that can be exploite...

CVE-2021-28821

The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local acce...

CVE-2021-20625

Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Bulletin Board via unspecified vectors...

CVE-2020-24877

A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass...

CVE-2020-35231

The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device...

CVE-2020-35231

The CVE-2020-35231 entry concerns the NETGEAR JGS516PE/GS116Ev2 NSDP protocol implementation (v2.6.0.43) with an authentication bypass that lets a remote attacker bypass access controls and obtain full device control. Multiple sources (NVD, Red Hat, CNVD, CNVD-derived entries) confirm an authenti...

CVE-2020-35231

The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device...

IBM DB2 安全漏洞

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A security vulnerability exists in IBM DB2, which can be exploited by an attacker to bypass access...

Emerson Smart Wireless Gateway 1420 4.6.59 Missing Authentication Vulnerability

Title: Missing access controls Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19419 Authors: Harsha Bhat, Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that...

Emerson Smart Wireless Gateway 1420 4.6.59 Missing Authentication

Title: Missing access controls Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19419 Authors: Harsha Bhat, Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that...

CVE-2021-26964

A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and manageme...

Default configuration

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewal...

CVE-2020-5148

SonicWall SSO-agent vulnerability CVE-2020-5148 occurs when NetAPI is used as the client probing method. NetAPI probing can allow an attacker to capture the privileged user’s password hash via NetWkstaUserEnum and may force the SSO-Agent to authenticate, potentially bypassing firewall access cont...

PT-2021-16920 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.24 Description: An issue was discovered where incorrect ACL checks could allow unauthorized change of the category for an article. Recommendations: For Joomla! versions 3.0.0 through 3.9.24, update to a...

ProSoft Technology ICX35

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ProSoft Technology Equipment: ICX35-HWC-A and ICX35-HWC-E Vulnerability: Permissions, Privileges, and Access Controls 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

Freebsd FreeBSD Competitive Conditions Problem Vulnerability

FreeBSD is a Unix-like operating system from the Freebsd Foundation. pts is a pseudo-terminal driver used in it. FreeBSD has a security vulnerability that can be exploited by an attacker to bypass access restrictions and read or modify data on the host system via jail attach...