Improper access control

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

CVE-2019-1622 Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

CVE-2019-1622 Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

Cross site scripting

DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting XSS vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls...

CVE-2019-9701

Symantec Data Loss Prevention (DLP) 15.5 MP1 and earlier versions are affected by a cross-site scripting (XSS) vulnerability in the web application’s input handling, allowing injection of client-side scripts into pages viewed by other users. Root cause: lack of proper validation of client-side da...

CVE-2019-9701

DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting XSS vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls...

URL Validation Bypass

jquery-mobile is vulnerable to URL validation bypass. Forward and Back slashes are not properly handled, which would allow remote attackers to bypass access controls or URL checks due to incorrect parsing of URLs, e.g. http://[email protected]/ is incorrectly considered the same domain as...

PT-2019-16949 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.2.0 through 10.4.0 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For versions 10.2.0 through 10.4.0, consider implementin...

CVE-2018-19999

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability,...

CVE-2018-19999

CVE-2018-19999 affects SolarWinds Serv-U FTP Server 15.1.6.25, where broken access controls in the local management interface allow an authenticated local attacker to bypass authentication and execute code with SYSTEM privileges. Exploitation requires local access and an active Serv-U admin conso...

Serv-U FTP Server 15.1.6.25 Local Privilege Escalation

Issue: Local Privilege Escalation CVE: CVE-2018-19999 Security researcher: Chris Moberly @ The Missing Link Security Product name: Serv-U FTP Server Product version: Tested on 15.1.6.25 current as of Dec 2018 Fixed in: 15.1.7 Overview The Serv-U FTP Server is vulnerable to authentication bypass...

Insecure Access Controls

novajoin uses insecure access controls. The lack of access controls allows an attacker to generate tokens from authenticated users to gain access to HTTP calls to the API...

Insecure Access Controls

postgresql is vulnerable to insecure access controls vulnerability. This is because the pgcatalog.pglogfilerotate function does not follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it and could use this flaw to force log rotation...

Privilege Escalation

Red Hat Satellite is vulnerable to privilege escalation vulnerability. This is because the Satellite 6 does not properly enforce access controls on certain resources. Remote authenticated users with unlimited filters could bypass organization and location restrictions and read or modify data for ...

Security Bypass

Red Hat Satellite is vulnerable to security bypass vulnerability. This is because the foreman in Satellite 6 does not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

PT-2019-2171 · Microsoft · Windows Error Reporting +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Error Reporting WER affected versions not specified Description: An elevation of privilege issue exists in the way Windows Error Reporting WER handles files. This vulnerability is related to insufficient access restrictions ...

WPGraphQL <= 0.2.3 - Multiple Vulnerabilities

Without authorisation, weak access controls allow us to: Create administrative users Post comments on articles bypassing article restrictions and global moderation Retrieve content of password-protected posts/articles/pages Retrieve full list of registered users in the platform Retrieve full list...

Access Controls Bypass

Mozilla Thunderbird is vulnerable to access controls bypass. File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. Malicious sites could lure users into...

Information Disclosure

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...