CVE-2008-7279: Undefined Security Weakness

The CustomerInterface component in Open Ticket Request System OTRS before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors...

CVE-2008-7282: Undefined Security Weakness

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System OTRS before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain 1 list and 2...

PT-2011-1270

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.3.0-beta4 Description The issue allows remote authenticated users to potentially bypass intended access restrictions. This occurs because the system checks for the wrong permission during...

PT-2011-1272

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.8 Description The issue allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers. Recommendations For versions prior to 2.2.8, upda...

PT-2011-1316

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.4 Description The issue allows remote authenticated users to bypass intended access restrictions by visiting a ticket, leveraging single-digit substrings of the CustomerID value. This can b...

PT-2011-1317

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.0-beta2 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the improper enforcement of the move into permission setting for a...

SugarCRM 6.1.1 - Information Disclosure

SugarCRM 6.1.1 - Information Disclosure source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead...

SugarCRM 6.1.1 - Information Disclosure

source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks...

CVE-2011-1088

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application...

PT-2011-3115

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.10 Description The issue allows remote attackers to bypass intended access restrictions via HTTP requests to a web application because it does not follow ServletSecurity annotations when web.xml has no...

CVE-2011-1088: Undefined Security Weakness

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application...

CVE-2011-1419: Undefined Security Weakness

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2011-1312

The Administrative Console component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by mapping a 1 user or 2 gro...

CVE-2011-1312: Undefined Security Weakness

The Administrative Console component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by mapping a 1 user or 2 gro...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an...

CVE-2011-1123

CVE-2011-1123 affects Google Chrome prior to 9.0.597.107, where access to internal extension functions is not properly restricted. The impact is unspecified, with remote attack vectors mentioned in the description. The provided connected documents corroborate the vulnerability presence across mul...

CVE-2011-0278: Undefined Security Weakness

Unspecified vulnerability in HP Web Jetadmin 10.2 Service Release 3 and 4 allows local users to bypass intended access restrictions via unknown vectors...

Directory traversal

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...

Design/Logic Flaw

ScripsOverlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information,...

CVE-2011-1008

ScripsOverlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information,...