CVE-2006-7243: Improper Input Validation

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the fileexists function...

CVE-2011-0316

The Administrative Console component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 does not properly restrict access to console servlets, which allows remote attackers to obtain potentially sensitive status information via a direct request...

CVE-2010-4680: Undefined Security Weakness

The WebVPN implementation on Cisco Adaptive Security Appliances ASA 5500 series devices with software before 8.23 permits the viewing of CIFS shares even when CIFS file browsing has been disabled, which allows remote authenticated users to bypass intended access restrictions via CIFS requests, ak...

CVE-2010-4678: Undefined Security Weakness

Cisco Adaptive Security Appliances ASA 5500 series devices with software before 8.23 permit packets to pass before the configuration has been loaded, which might allow remote attackers to bypass intended access restrictions by sending network traffic during device startup, aka Bug ID CSCsy86769...

PolyVision RoomWizard insecurely stores Sync Connector Active Directory credentials and uses default administrative password

Overview The PolyVision RoomWizard web based scheduling system with touch screen display contains two vulnerabilities that allow an unauthorized user to access the device console and Sync Connector Active Directory credentials. Description The PolyVision RoomWizard is a touch screen scheduling...

CVE-2010-0215: Undefined Security Weakness

ActiveCollab before 2.3.2 allows remote authenticated users to bypass intended access restrictions, and 1 delete an attachment or 2 subscribe to an object, via a crafted URL...

CVE-2010-4675: Undefined Security Weakness

Cisco Adaptive Security Appliances ASA 5500 series devices with software before 8.23 do not properly determine the interfaces for which TELNET connections should be permitted, which allows remote authenticated users to bypass intended access restrictions via vectors involving the "lowest security...

PT-2010-5549

Name of the Vulnerable Software and Affected Versions Opera versions prior to 11.00 Description The issue is related to the handling of security policies during updates to extensions. This might allow remote attackers to bypass intended access restrictions via unspecified vectors. Recommendations...

WordPress < 3.0.3 XML-RPC Interface Access Restriction Bypass

According to its version number, the installation of WordPress is prior to 3.0.3. It is, therefore, affected by a security bypass vulnerability. Certain access control restrictions are not properly enforced, which could allow a remote, authenticated user to perform unauthorized actions such as...

PT-2010-5531

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes Traveler versions prior to 8.5.1.3 Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved by performing a Replace Data operation for a prohibited application on the Noki...

PT-2010-5528

Name of the Vulnerable Software and Affected Versions IBM Lotus Notes Traveler versions prior to 8.5.1.2 Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved by not rejecting an attachment download request for an e-mail message with a...

JVN#48425028: Flash Player access restriction bypass vulnerability

When Flash Player references a different website than the site where Flash contents are hosted, the referenced site must be allowed access by the cross-domain policy file. Flash Player contains a vulnerability where access restrictions set by the cross-domain policy file may be bypassed. Impact...

CVE-2010-3636: Undefined Security Weakness

Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictio...

CVE-2010-3863

CVE-2010-3863 affects Apache Shiro (before 1.1.0) and JSecurity 0.9.x. The root cause is failure to canonicalize URI paths before comparing them to entries in the shiro.ini filter, allowing a remote attacker to bypass access restrictions with crafted requests such as GET /./account/index.jsp. The...

CVE-2010-4105: Undefined Security Weakness

Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access restrictions, and obtain sensitive information or modify data, via unknown vectors...

CVE-2010-3713

rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed...

CVE-2010-3713

rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed...

CVE-2010-4041: Undefined Security Weakness

The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access restrictions via unspecified vectors...

SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6572)

This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. CVE-2009-1195 - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network...

CVE-2010-3779

CVE-2010-3779 affects Dovecot 1.2.x (pre-1.2.15) and 2.0.x (pre-2.0.beta2). The issue is an ACL misconfiguration that can let a remote authenticated user bypass mailbox access restrictions by altering the ACL of a mailbox, demonstrated via a symlinked shared mailbox; the admin permission can be g...