Insecure Access Controls

postgresql is vulnerable to insecure access controls vulnerability. This is because the pgcatalog.pglogfilerotate function does not follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it and could use this flaw to force log rotation...

Privilege Escalation

Red Hat Satellite is vulnerable to privilege escalation vulnerability. This is because the Satellite 6 does not properly enforce access controls on certain resources. Remote authenticated users with unlimited filters could bypass organization and location restrictions and read or modify data for ...

Security Bypass

Red Hat Satellite is vulnerable to security bypass vulnerability. This is because the foreman in Satellite 6 does not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

PT-2019-2171 · Microsoft · Windows Error Reporting +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Error Reporting WER affected versions not specified Description: An elevation of privilege issue exists in the way Windows Error Reporting WER handles files. This vulnerability is related to insufficient access restrictions ...

WPGraphQL <= 0.2.3 - Multiple Vulnerabilities

Without authorisation, weak access controls allow us to: Create administrative users Post comments on articles bypassing article restrictions and global moderation Retrieve content of password-protected posts/articles/pages Retrieve full list of registered users in the platform Retrieve full list...

Access Controls Bypass

Mozilla Thunderbird is vulnerable to access controls bypass. File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. Malicious sites could lure users into...

Information Disclosure

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Access Restriction Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

CVE-2019-6494

IMFForceDelete.sys in IObit Malware Fighter 6.2 allows a low privileged user to send IOCTL 0x8016E000 along with a user defined string to a file; that file will be promptly deleted regardless of access controls...

Cisco RV320 < 1.4.2.22 Multiple Vulnerabilities

Binary data 700566.prm...

Cisco RV325 < 1.4.2.22 Multiple Vulnerabilities

Binary data 700567.prm...

Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)

According to its self-reported version, this Cisco Small Business RV Series router is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker wi...

CVE-2019-9696

Symantec VIP Enterprise Gateway all versions may be susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentiall...

CVE-2018-14894

CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker who is able to edit permissions of a file to bypass intended access restrictions and execute blocked applications...

CVE-2018-19589

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

CVE-2018-19589

The CVE-2018-19589 describes incorrect access controls in the PKCS11 R2 provider shipping with Utimaco CryptoServer HSM. An SO authenticated to a slot can retrieve attributes of keys marked as private in external key storage and can delete such keys, potentially compromising availability of all e...

CVE-2018-19589

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

CVE-2018-4324

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...

CVE-2018-4324

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...

Design/Logic Flaw

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...