Missing access controls in loadattachmentversions action

The loadattachmentsversions action is accessible to any user of Confluence and returns version history information for an attachment. No access controls appear to be implemented for this action and any user of Confluence can obtain version history for any attachment, including those on pages in...

Missing access controls in loadattachmentversions action

The loadattachmentsversions action is accessible to any user of Confluence and returns version history information for an attachment. No access controls appear to be implemented for this action and any user of Confluence can obtain version history for any attachment, including those on pages in...

Missing access controls in loadattachmentversions action

The loadattachmentsversions action is accessible to any user of Confluence and returns version history information for an attachment. No access controls appear to be implemented for this action and any user of Confluence can obtain version history for any attachment, including those on pages in...

CVE-2013-4310

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix...

CVE-2013-4310

CVE-2013-4310 is an Apache Struts 2 vulnerability (prefix action: bypass) with a CVSS v2 base score 5.8 (network, low complexity). IBM security bullets tie this to IBM SAN Volume Controller, Storwize family, Storwize V7000, V5000, V3700, V3500 (Lenovo) and related IBM Flex System components. In I...

[ThreatFactor NSIA v1.0.6] Network System Integrity Analysis

ThreatFactor NSIA is a website scanner that monitors websites in real-time in order to detect defacements, compliance violations, exploits, sensitive information disclosure and other issues. ThreatFactor detects issues remotely and therefore requires no software to install, does not introduce any...

User invite functionality available to non-admins

The REST API which manages user invites ensures that only adminstrators can generate a new invite token. However, no similar access controls are present on the methods which are used to invite new users, or to revert to the previous security token – these can be successfully called by any...

User invite functionality available to non-admins

The REST API which manages user invites ensures that only adminstrators can generate a new invite token. However, no similar access controls are present on the methods which are used to invite new users, or to revert to the previous security token – these can be successfully called by any...

User invite functionality available to non-admins

The REST API which manages user invites ensures that only adminstrators can generate a new invite token. However, no similar access controls are present on the methods which are used to invite new users, or to revert to the previous security token – these can be successfully called by any...

MGASA-2013-0263 Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage

Updated 389-ds-base packages fix security vulnerabilities: It was discovered that the 389 Directory Server did not honor defined attribute access controls when evaluating search filter expressions. A remote attacker with permission to query the Directory Server could use this flaw to determine th...

Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage

Updated 389-ds-base packages fix security vulnerabilities: It was discovered that the 389 Directory Server did not honor defined attribute access controls when evaluating search filter expressions. A remote attacker with permission to query the Directory Server could use this flaw to determine th...

Cisco Finesse Directory Read Vulnerability

A vulnerability in the web interface of Cisco Finesse could allow an unauthenticated, remote attacker to read the contents of a directory on the server. The vulnerability is due to insufficient access controls on directory access. An attacker could exploit this vulnerability by visiting a URL tha...

Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20130730)

It was discovered that the 389 Directory Server did not honor defined attribute access controls when evaluating search filter expressions. A remote attacker with permission to query the Directory Server could use this flaw to determine the values of restricted attributes via a series of search...

Moderate: Red Hat Security Advisory: 389-ds-base security and bug fix update

Updated 389-ds-base packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Moderate: Red Hat Security Advisory: redhat-ds-base security and bug fix update

Updated redhat-ds-base packages that fix one security issue and several bugs are now available for Red Hat Directory Server 8.2. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detail...

CVE-2012-5217

HP System Management Homepage SMH before 7.2.1 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2013-2355...

IBM Rational ClearQuest Multiple Information Disclosure Vulnerabilities

IBM Rational ClearQuest is prone to multiple information disclosure vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

IBM Rational ClearQuest Multiple Information Disclosure Vulnerabilities

This host is installed with IBM Rational ClearQuest and is prone to multiple information disclosure vulnerabilities. OpenVAS Vulnerability Test $Id: gbibmrationalclearquestmultinfodiscvuln.nasl 6093 2017-05-10 09:03:18Z teissa $ IBM Rational ClearQuest Multiple Information Disclosure...

PT-2013-3518 · Apache +2 · Apache Tomcat +2

Name of the Vulnerable Software and Affected Versions: Apache Tomcat 6 versions affected versions not specified Description: The issue allows remote attackers to bypass intended access restrictions by performing a replay attack after a nonce becomes stale. This is due to an incomplete fix for a...

DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities

Title ----- DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities Severity -------- High Date Discovered --------------- March 19, 2013 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Dennis Lavrinenko, Bobby Lockett, and r@b13$ 1. Actuate...