samba: SMB clients can truncate files with read-only permissions

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "aclxattr" is configured with "aclxattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only acces...

CVE-2023-47757

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...

CVE-2023-47757 WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...

Race condition

The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized...

PT-2023-35586 · Git +1 · Opensc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Invalid-free. The crash state involves several function calls, including sc file clear acl entries, sc...

USN-6425-1: Samba vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Sri Nagasubramanian discovered that the Samba aclxattr VFS module incorrectly handled read-only files. When Samba is configured to ignore system ACLs, a remote attacker could possibly use this issue to...

CVE-2023-46728

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid. This issue may lead to a remote denial ...

Fedora 39 : matrix-synapse (2023-4d4c73a8f0)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4d4c73a8f0 advisory. Update to v1.94.0 CVE-2023-45129 ---- Update to v1.93.0 CVE-2023-41335, CVE-2023-42453 Tenable has extracted the preceding description block directl...

Cisco IOS XR Software Compression ACL Bypass (cisco-sa-comp3acl-vGmp6BQ3)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the classic access control list ACL compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL o...

Rocky Linux 8 : libarchive (RLSA-2022:0892)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0892 advisory. - An improper link resolution flaw while extracting an archive can lead to changing the access control list ACL of the target of the link. An attacker m...

Rocky Linux 8 : redis:5 (RLSA-2021:3918)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:3918 advisory. - Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the...

The vulnerability of the /goform/formSetACLFilter component of the D-Link N300 WI-Fi Router DIR-605L software, which allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the /goform/formSetACLFilter component in the D-Link N300 Wi-Fi Router DIR-605L wireless access point software relates to the ability to write data beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to cause service interruptions or execute...

The vulnerability of the /goform/formSetACLFilter component of the D-Link N300 WI-Fi Router DIR-605L software, which allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the /goform/formSetWanDhcpplus component in the D-Link N300 WI-Fi Router DIR-605L wireless access point lies in the ability to write data beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to cause service interruptions or execute arbitrary cod...

CVE-2023-20245

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

Improper access control

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

CVE-2023-20245

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

CVE-2023-20245

CVE-2023-20245 affects Cisco ASA and Cisco FTD where multiple vulnerabilities in the per-user-override feature can allow an unauthenticated, remote attacker to bypass configured ACLs and let denied traffic flow through an affected device. The issues stem from a logic error in how per-user-overrid...

CVE-2023-20256

CVE-2023-20256 relates to multiple vulnerabilities in the per-user-override feature of Cisco ASA and FTD software that could let an unauthenticated, remote attacker bypass ACLs and reach normally protected resources. The root cause is a logic error in how per-user-override rules are constructed/a...

CVE-2023-20256

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software AnyConnect Access Control List Bypass Vulnerabilities

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...