CVE-2015-3321

CVE-2015-3321 affects Lenovo Fingerprint Manager prior to 8.01.42. The root cause is incorrect ACLs on services and files, allowing a local user to invalidate local checks and escalate privileges by executing with administrator rights. Affected products include a range of Lenovo ThinkCentre/Think...

CVE-2017-9803

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider...

aclcargo.nl XSS vulnerability

Vulnerable URL: http://www.aclcargo.nl/search.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure Timeline:...

CVE-2017-9803

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider...

CVE-2017-9803

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider...

Security update for qemu (important)

This update for qemu fixes the following issues: Security issues fixed: CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 CVE-2017-11334: Fix OOB access during DMA operation bsc1048902...

openSUSE Security Update : qemu (openSUSE-2017-1072)

This update for qemu fixes the following issues : Security issues fixed : - CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 - CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 - CVE-2017-11334: Fix OOB access during DMA operation...

CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

DEBIAN-CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

ALPINE-CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

CVE-2017-7650

CVE-2017-7650 affects Eclipse Mosquitto up to version 1.4.11 (before 1.4.12). The vulnerability arises from pattern-based ACLs that can be bypassed when clients set their username or client id to '#' or '+', allowing locally or remotely connected clients to access MQTT topics they should not be a...

CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

The vulnerability of the ACL component of the NoviWare operating system allows a attacker to gain access to the network interface of the novi_process_manager_daemon service and execute arbitrary code in privileged mode on the switch.

The vulnerability of NoviWare’s operating system component stems from the improper handling of unserialized network packets, which leads to buffer overflows on the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code during the application of ACL modifications,...

The vulnerability of NoviWare’s operating system component, caused by a buffer overflow in the stack, allows an attacker to execute arbitrary code.

The vulnerability of NoviWare’s operating system component lies in the overflow of memory in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code during the application of ACL changes, using specially crafted network packets containing operating system...

CVE-2017-12213

A vulnerability in the dynamic access control list ACL feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the attacker to pass traffic...

Input validation

A vulnerability in the dynamic access control list ACL feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the attacker to pass traffic...

CVE-2017-12213

The CVE-2017-12213 issue affects Cisco Catalyst 4000 Series Switches running IOS XE. It stems from an uncaught error when reassigning the auth-default-ACL dynamic ACL after 802.1x authentication fails, allowing an unauthenticated adjacent attacker to cause the dynamic ACL to fail open and forward...