PT-2017-19190

Name of the Vulnerable Software and Affected Versions Apache Impala incubating versions prior to 2.10.0 Description A malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the...

Improper access control

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the 'follow schedule' function...

SMA Solar Technology inverter Man-in-the-Middle Attack Vulnerability

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. A security vulnerability exists in the SMA Solar Technology inverter that stems from a failure to properly use cryptographic authentication. An attacker could use this vulnerability to conduct man-in-the-middle and...

CVE-2017-10818

MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal Agent and spoof the Relay Service...

CVE-2017-10817: Improper Authentication

MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server...

CVE-2017-11174

In install/pagedbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses...

Sql injection

In install/pagedbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses...

BBCBuilder e-commerce system has design flaws

BBCbuilder is a new model of b2b2c e-commerce system built by Yuanfeng Company. BBCBuilder e-commerce system has a logical design vulnerability. An attacker can modify the number of products purchased after logging in and then modify the payment amount by grabbing packets...

Cambium Networks ePMP Access Control Error Vulnerability

Cambium Networks ePMP is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. An access control error vulnerability exists in Cambium Networks ePMP. A remote attacker could exploit the vulnerabili...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-2192

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own...

CVE-2016-0767

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...

CVE-2016-2192

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own...

CVE-2017-3741

In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation...

PT-2017-16074

Name of the Vulnerable Software and Affected Versions Lenovo Active Protection System versions prior to 1.82.0.14 Description The issue allows an attacker with local privileges to send commands to the system's embedded controller. This could result in a denial of service attack on the system or t...

Design/Logic Flaw

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors...

CVE-2017-2091

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors...

CVE-2017-2094

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors...

CVE-2017-2091

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors...

PT-2017-10429

Name of the Vulnerable Software and Affected Versions Microsoft Lync for Mac 2011 Description The issue arises from the failure to properly validate certificates, which allows remote attackers to alter server-client communications. Recommendations For Microsoft Lync for Mac 2011, ensure that...