CVE-2018-6501

Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center ArcMC for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls...

CVE-2018-15610 Improper access controls in IP Office one-X Portal

A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2...

ALPINE-CVE-2018-10919

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are...

LG Products SystemUI application intents Access Control Error Vulnerability

LG devices based on Android are smart devices based on the Android platform from the South Korean LG Group. SystemUI application intents is one of the system applications. A security vulnerability exists in SystemUI application intents in LG products based on the Android versions 6.0 to 8.1...

Design/Logic Flaw

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

CVE-2018-0428

CVE-2018-0428 is a Cisco Web Security Appliance (WSA) elevation-of-privilege vulnerability in the account management subsystem. An authenticated local attacker with valid admin credentials can bypass access controls to elevate to root, escape the CLI subshell, and run system-level commands. The r...

CVE-2018-0428

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

CVE-2018-0428

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

Cisco Web Security Appliance Privilege Escalation Vulnerability

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

Threatlist: Manufacturing, a Top Target for Espionage

When it comes to cyberattack-related reconnaissance and lateral movement activity, the manufacturing industry exhibits higher than normal rates. That’s according to Vectra’s 2018 Spotlight Report on Manufacturing, which crunched data from more than 4 million devices and workloads from customer...

Thompson Reuters UltraTax CS 2017 for Windows Information Disclosure Vulnerability

Thompson Reuters UltraTax CS 2017 for Windows is a Windows-based automated tax management software from Thompson Reuters, USA. The software is primarily used to automate the management of business or personal tax workflows. An information disclosure vulnerability exists in Thompson Reuters UltraT...

Chaturbate: Add non-existent room moderator

Description A broadcaster can add or remove a non-existent user as a moderator. This is submitted using the testbed as it wasn't possible to initiate a broadcast on the production site. Steps 1. As a broadcaster add a moderator to the broadcast attachment 1. 2. Observe the request sent to the...

Cisco Policy Suite Local Information Disclosure Vulnerability

Cisco Policy Suite is a carrier-grade policy, charging, and subscriber data management solution. A local information disclosure vulnerability exists in the CLI of Cisco Policy Suite. The vulnerability stems from insufficient access control privileges. An attacker can exploit the vulnerability by...

Lenovo Help Android app information disclosure vulnerability

Lenovo Help Android app is a Chinese Lenovo Lenovo application that provides online support for Lenovo products such as computers, cell phones and data centers. The app is mainly used to check device information and warranty status of Lenovo products, etc. A security vulnerability exists in the...

DEBIAN-CVE-2014-2079

X File Explorer aka xfe might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use directory masks when creating files on Samba and NFS shares...

Code injection

Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versions SD 210/SD 212/SD 205, SD 845, SD 850...

Debian: Security Advisory (DSA-4240-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-11257

Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versions SD 210/SD 212/SD 205, SD 845, SD 850...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to privilege escalation

Summary A privilege escalation vulnerability was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-1350 DESCRIPTION: IBM InfoSphere Information Server could allow a user to escalate their privileges to administrator due to improper access controls. CVSS Base...

PT-2018-11162

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 0.31.2 Description The issue allows unauthorized users to hijack rooms when there is no m.room.power levels event in force. This can lead to unauthorized access and control over rooms. Recommendations For versions pri...