CVE-2019-9742

gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\gdwfpcd device are not properly protected, leading to unintended impersonation or...

CVE-2019-9742

gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\gdwfpcd device are not properly protected, leading to unintended impersonation or...

CVE-2019-9742

gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\gdwfpcd device are not properly protected, leading to unintended impersonation or...

CVE-2019-9742

CVE-2019-9742 affects G Data Software Total Security prior to 2019-02-22, via the driver gdwfpcd.sys. The vulnerability stems from Interpreted Device Characteristics lacking FILE_DEVICE_SECURE_OPEN, allowing an attacker to bypass ACLs and access files/directories inside the \.\gdwfpcd device, ena...

Joomla! < 3.9.4 Multiple Vulnerabilities

Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; ifdescription...

Joomla! 3.0.x < 3.9.4 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - Lack of ACL checks in sample data plugins affects Joomla 3.8.0 through 3.9.3 - XSS in comconfig JSON handler affects Joomla 3.2.0 through 3.9.3 - XSS in itemtitle layout...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access...

CVE-2019-9713

An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access...

CVE-2019-9713

An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access...

CVE-2019-9713

An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access...

CVE-2019-9713

CVE-2019-9713 affects Joomla! before 3.9.4. The vulnerability arises from missing ACL checks in the Sample Data plugins, enabling unauthorized access. CVSSv3 base score 7.5 (NETWORK, LOW attack complexity, PR:N, UI:N, S:U, C:H, I:N, A:N); CVSSv2 base score 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N). Implic...

Android - getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass Exploit

Android - getpidcon Usage in Hardware binder ServiceManager Permits ACL Bypass Exploit We already reported four bugs in Android that are caused by the use of getpidcon, which is fundamentally unsafe: https://bugs.chromium.org/p/project-zero/issues/detail?id=727 AndroidID-27111481; unexploitable...

Android - getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass

We already reported four bugs in Android that are caused by the use of getpidcon, which is fundamentally unsafe: https://bugs.chromium.org/p/project-zero/issues/detail?id=727 AndroidID-27111481; unexploitable https://bugs.chromium.org/p/project-zero/issues/detail?id=851 AndroidID-29431260;...

[20190304] - Core - Missing ACL check in sample data plugins

The sample data plugins lack ACL checks, allowing unauthorized access...

Security update for mosquitto (low)

openSUSE Security Update: Security update for mosquitto Announcement ID: openSUSE-SU-2019:0237-1 Rating: low References: 1125019 1125020 1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Backports SLE-15 An update that fixes three vulnerabilities i...

pfSense HAProxy package cross-site scripting vulnerability

pfsense is an open source routing and firewall software , based on freebsd system customization and development . A cross-site scripting vulnerability exists in pfSense's HAProxy package before version 0.5916. A remote attacker can use this vulnerability to inject arbitrary Web script or HTML wit...

Security update for mosquitto (low)

openSUSE Security Update: Security update for mosquitto Announcement ID: openSUSE-SU-2019:0233-1 Rating: low References: 1125019 1125020 1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilities is now...

PT-2019-5609 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions up to 3.10 Description: A denial of service situation can be created by an attacker with local access via a NULL pointer dereference in the ovl posix acl create function in fs/overlayfs/dir.c. This allows attackers who c...

Insecure Authorization

libmosquitto.so is vulnerable to insecure authorization. An empty ACL file or containing only blank lines or comments is treated as not defined and no topic access would be denied. This could lead to access being incorrectly granted and allow an attacker to access or modify resources that are...

Design/Logic Flaw

EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\EPP device are not properly protected, leading to unintended impersonation or objec...