Authentication flaw

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server ATS 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrad...

CVE-2018-1318

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server ATS 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrad...

CVE-2018-1318

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server ATS 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrad...

CVE-2018-1318

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server ATS 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrad...

Security Advisory 0036

Security Advisory 0036 . CSAF PDF Date: August 6th, 2018 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | August 6, 2018 | Initial Release Vulnerability assessment of CVE-2018-5390 for Arista Products CVSS v2: 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C On August 6th, 2018, information was released...

Hashicorp Consul Web UI and API access

A remote, unauthenticated attacker may able to access Consul Web UI and API to gather data, register services and gain remote access. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid111351; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

Intel Processor Diagnostic Tool (IPDT) Privilege Escalation

Hi @ll, the executable installers of Intel's Processor Diagnostic Tool IPDT before v4.1.0.27 have three vulnerabilities^Wbeginner's errors which all allow arbitrary code execution with escalation of privilege, plus a fourth which allows denial of service. Intel published advisory SA-00140 on...

Access Restriction Bypass

Mosquitto is vulnerable to access restriction bypass. It does not perform ACL check for the clients with clientid or username including symbols or + when pattern based ACLs is used...

Fedora 26 : mysql-mmm (2018-92f04c6b61)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

Fedora 27 : mysql-mmm (2018-e31f52c5ee)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

PostgreSQL logrotate Vulnerability (May 2018) - Windows

PostgreSQL is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Authentication flaw

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

CVE-2015-9256

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default...

Default credentials

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default...

CVE-2015-9256

CVE-2015-9256 affects Datto ALTO and SIRIS devices. The flaw arises because restore mount points (device/VM) are accessible without ACLs by default, enabling remote attackers to obtain sensitive information from these mounts. The connected records corroborate the issue’s existence and affected co...

CVE-2016-8520

HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...

CVE-2018-0090

A vulnerability in management interface access control list ACL configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to...

CVE-2017-8038

In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists ACLs enforce whether an authenticated user can perform an operation on a credential. For installations using ACLs, the ACL was bypassed for the CredHub interpolate endpoint, allowing authenticated applications to view...

Vulnerability in core server (CVE-2017-7548)

loput function ignores ACLs...

ACLight - PowerShell Script for Advanced Discovery of Privileged Accounts (includes Shadow Admins)

ACLight is a tool for discovering privileged accounts through advanced ACLs Access Lists analysis. It includes the discovery of Shadow Admins in the scanned network. The tool queries the Active Directory AD for its objects' ACLs and then filters and analyzes the sensitive permissions of each one...