The vulnerability of the Database Gateway for ODBC component of the Oracle Database Server allows a hacker to gain full control over the application.

The vulnerability of the Oracle Database Server ODBC driver’s database server lies in its lack of access control mechanisms. Exploiting this vulnerability allows an attacker to gain full control over the application through the OracleNet network protocol...

Authorization Bypass

node is vulnerable to authorization bypass. Trailing OWS from header values are not stripped, potentially allowing a remote attacker to bypass access controls...

Security Bulletin: Multiple Information disclosure vulnerabilities affect IBM Sterling B2B Integrator (CVE-2017-1302, CVE-2017-1193)

Summary IBM Sterling B2B Integrator Standard Edition could allow a local user to view sensitive information due to improper access controls Vulnerability Details CVEID: CVE-2017-1302 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a local user to view sensitive information d...

DEBIAN-CVE-2020-7955

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3...

5 identity priorities for 2020

Today, Joy Chik, Corporate Vice President of Identity, shared five priorities central to security that organizations should prioritize in 2020 as they digitally transform. These priorities are based on many conversations with our customers, including: 1. Connect all applications and cloud resourc...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Huawei EulerOS: Security Advisory for openldap (EulerOS-SA-2019-2178)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openldap (EulerOS-SA-2020-1077)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.5.0 : systemd (EulerOS-SA-2020-1054)

According to the version of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the...

EulerOS Virtualization for ARM 64 3.0.5.0 : openldap (EulerOS-SA-2020-1077)

According to the version of the openldap packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relyi...

Google Android Framework Component Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple privilege-escalation vulnerabilities 2. A denial-of-service vulnerability An attacker can exploit these issues to gain elevated privileges, and cause denial-of-service conditions. These issues are being...

Google Android Media Framework CVE-2020-0002 Multiple Remote Code Execution Vulnerabilities

Description Google Android is prone to multiple remote code-execution vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of a privileged process. Failed attacks may cause a denial-of-service condition. These issues are being tracked by Android Bug ID...

F5 Networks BIG-IP : SCP vulnerability (K54336216)

The system does not properly enforce the access controls for the scp.whitelist and scp.blacklist files whenpaths are symbolic links symlinks. This allows authenticated users with Secure Copy SCP protocol access to overwrite certain configuration files that would otherwise be restricted...

WordPress Featured Image from URL plugin <= 2.7.7 - Missing Access Controls on REST routes vulnerability

Missing Access Controls on REST routes vulnerability found in WordPress Featured Image from URL plugin versions = 2.7.7. Solution Update the WordPress Featured Image from URL plugin to the latest available version at least 2.7.8...

CVE-2019-6679

On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access controls implemented by scp.whitelist and scp.blacklist are not properly enforced for paths that are symlinks. This allows authenticated users wi...

CVE-2019-6679

Summary: CVE-2019-6679 affects BIG-IP systems where SCP access controls (scp.whitelist/scp.blacklist) fail to enforce permissions for symlink paths. This allows authenticated users with SCP access to overwrite certain configuration files that should be restricted. Affected versions (per sources):...

Cisco IOS XE Software MACsec MKA Using EAP-TLS Authentication Bypass (cisco-sa-20180926-macsec)

According to its self-reported version, Cisco IOS XE Software is affected by an authentication bypass vulnerability in the MACsec Key Agreement MKA using Extensible Authentication Protocol-Transport Layer Security EAP-TLS functionality due to a logic error. An unauthenticated, adjacent attacker c...

The vulnerability of the recv_files and read_ndx_and attrs functions in the rsync daemon allows a hacker to circumvent existing access restrictions and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of rsync exists due to the lack of checks on the filenames fnamecmp in the daemonfilterlist data structure in the recvfiles function in receiver.c, and the absence of a sanitizepaths mechanism for paths found in the “xname follows” strings in the readndxand attrs function in...

SQL Server 2019 Security Tool Inadvertently Reveals Where Sensitive Data is Stored

The first step in protecting your data and ensuring your database is compliant with security benchmarks and privacy regulations such as SOX, PCI, HIPAA, and GDPR is to understand what sensitive information resides in that database. Microsoft’s SQL Server 2019 introduces a new tool SQL Data...

envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure

A flaw was found in envoy. A malformed request header may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...