CVE-2020-5293

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...

CVE-2020-5293

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...

CVE-2020-5288

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5...

Improper access control

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...

Improper access control

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5...

CVE-2020-5288

CVE-2020-5288 affects PrestaShop versions 1.7.0.0–1.7.6.5, with improper access controls on the product attributes page. The root cause is access control misconfigurations that could expose resources to unauthorized roles. The issue is fixed in version 1.7.6.5. No exploitation details are provide...

CVE-2020-5293

PrestaShop CVE-2020-5293 involves improper access controls on the product page (combinations, attachments, and specific prices) affecting versions 1.7.0.0 through 1.7.6.5. The vulnerability is fixed in 1.7.6.5. The Red Hat and other CVE mirrors reiterate this issue. Practical impact as stated: at...

Rank Math 0.9~1.0.42.1 - Missing Access Controls to Disable Competitor Plugins

Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users such as subscribers to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF. PoC...

Cisco Webex Meetings Access Control Error Vulnerability

Cisco Webex Meetings is a set of video conferencing solutions from Cisco USA. An access control error vulnerability exists in the Multimedia Viewer feature of Cisco Webex Meetings, which originates from a security warning dialog box that does not pop up when the host of the meeting room views a...

PT-2020-2495 · Oracle · Oracle Outside In Technology

Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology versions 8.5.4 Description: The issue is related to insufficient access controls in the Outside In Filters component of Oracle Outside In Technology, a suite of software development kits SDKs. This can be exploite...

VMware vCenter Server 6.7 Sensitive Information Disclosure Vulnerability (VMSA-2020-0006)

The version of VMware vCenter Server installed on the remote host is 6.7 prior to U3F, and is, therefore, affected by an information disclosure vulnerability caused by insufficient access controls in vmdir. This allows an attacker with network access to an affected vmdir deployment may be able to...

CVE-2020-3952

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls...

CVE-2020-3952

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls...

CVE-2020-3952 - VMware vCenter Server vmdir Information Disclosure

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. Recent assessments: wvu-r7 at April 16, 2020 1:25pm UTC reported: Technical details on the vuln are out:...

CVE-2019-18802

A flaw was found in envoy. A malformed request header may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Protecting your data and maintaining compliance in a remote work environment

In this difficult time, remote work is becoming the new normal for many companies around the world. Employees are using tools like Microsoft Teams to collaborate, chat, and connect in new ways to try to keep their businesses moving forward amidst the challenging global health crisis. I sincerely...

ManageEngine Desktop Central < 10 Build 10.0.515 Information Disclosure

The ManageEngine Desktop Central application running on the remote host is prior to version 10 build 10.0.515. It is, therefore, affected by an information disclosure vulnerability in the PDFGenerationServlet component due to improper access controls. An unauthenticated, remote attacker can explo...

CVE-2018-18955

A flaw was found in the Linux kernel where mapwrite in kernel/usernamespace.c allows privilege escalation as it mishandles nested user namespaces with more than 5 UID or GID ranges. An unprivileged user with CAPSYSADMIN in an affected user namespace can bypass access controls on resources outside...

Updated nghttp2 packages fix security vulnerability

Malformed request header may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure CVE-2019-18802...

Acronis: Broken Access Controls

The End Point notary.acronis.com Blocks access to the panel if you are not an authenticated user. More is possible to access some functions of the panel by adding the .html at the end See Poc From Video Below Impact Broken access control vulnerabilities exist when a user can in fact access some...