IP-in-IP protocol routes arbitrary traffic by default

Overview IP Encapsulation within IP RFC2003 IP-in-IP can be abused by an unauthenticated attacker to unexpectedly route arbitrary network traffic through a vulnerable device. Description IP-in-IP encapsulation is a tunneling protocol specified in RFC 2003 that allows for IP packets to be...

The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application for automating budget management processes is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protect...

The vulnerabilities of the Caching components, CacheStore, and the software platform for data processing in Oracle Coherence allow a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Caching, CacheStore, and Invocation components of the Oracle Coherence data processing software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information through the HT...

ABB Central Licensing System

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Central Licensing System CLS Vulnerabilities: Information Exposure; Improper Restriction of XML External Entity Reference; Uncontrolled Resource Consumption; Permissions, Privilege,...

HTTP Request Smuggling

puma is vulnerable to HTTP request smuggling. By using an invalid Transfer-Encoding header, an attacker is able to smuggle an HTTP request to bypass access controls and obtain confidential information...

Ubuntu: Security Advisory (USN-4355-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4355-1: PulseAudio vulnerability

PulseAudio in Ubuntu contains additional functionality to mediate audio recording for snap packages and it was discovered that this functionality did not mediate PulseAudio module unloading. An attacker-controlled snap with only the audio-playback interface connected could exploit this to bypass...

USN-4355-1 pulseaudio vulnerability

PulseAudio in Ubuntu contains additional functionality to mediate audio recording for snap packages and it was discovered that this functionality did not mediate PulseAudio module unloading. An attacker-controlled snap with only the audio-playback interface connected could exploit this to bypass...

vBulletin < 5.6.1 Security Patch Level 1 Vulnerability

vBulletin has incorrect access controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vbulletin:vbulletin"; ifdescription...

bitcoind and Bitcoin-Qt permissions licenses and access controls

A security vulnerability exists in bitcoind and Bitcoin-Qt versions 0.8.0 to 0.8.0:rc1, which stems from the program's failure to implement protocol rules for certain blocks. A remote attacker could exploit the vulnerability to bypass established access restrictions and perform a double-spending...

LY Corporation: Spring Actuator endpoints publicly available, leading to account takeover

Due to insufficient access controls, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. The /heapdump endpoint leaks data from the Java Virtual Machine, leading to disclosure of admin credentials, user tokens and a combination of other data. This endpoint was not...

The vulnerability of Google Chrome’s Blink rendering module, related to improper access control to critical resources, allows attackers to compromise data integrity.

The vulnerability of Google Chrome’s Blink rendering module is related to improper control of access to critical resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise data integrity through a specially created HTML page...

CVE-2020-5293

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...

CVE-2020-5293

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...

CVE-2020-5288

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5...

CVE-2020-5288

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5...

Improper access control

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...

Improper access control

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5...

CVE-2020-5288

CVE-2020-5288 affects PrestaShop versions 1.7.0.0–1.7.6.5, with improper access controls on the product attributes page. The root cause is access control misconfigurations that could expose resources to unauthorized roles. The issue is fixed in version 1.7.6.5. No exploitation details are provide...

CVE-2020-5293

PrestaShop CVE-2020-5293 involves improper access controls on the product page (combinations, attachments, and specific prices) affecting versions 1.7.0.0 through 1.7.6.5. The vulnerability is fixed in 1.7.6.5. The Red Hat and other CVE mirrors reiterate this issue. Practical impact as stated: at...