CVE-2021-27582

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

Authorization

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

CVE-2021-27582

MITREid Connect OpenID Connect server (MITREid Connect) before 1.3.3 is affected by a Mass Assignment (Autobinding) vulnerability in OAuthConfirmationController.java. The issue arises from unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, allowing HTTP request pa...

CVE-2021-27582

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

Ovarro TBox (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Ovarro Equipment: TBoxLT2 All models, TBox MS-CPU32, TBox MS-CPU32-S2, TBox RM2 All models, TBox TG2 All models --------- Begin Update A Part 1 of 3 --------- Vulnerabilities: Code Injection,...

The vulnerability of the BLIP protocol analyzer in Wireshark software allows a hacker to trigger a service failure.

The vulnerability of the BLIP protocol analyzer in Wireshark is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2021-17521 · Mitre · Mitreid Connect

Name of the Vulnerable Software and Affected Versions: MITREid Connect versions through 1.3.3 Description: The OpenID Connect server implementation for MITREid Connect contains a Mass Assignment vulnerability, also known as Autobinding. This issue arises due to the unsafe usage of the...

The vulnerability of Intel Graphics Driver drivers lies in the lack of checking for the value of the pointer before its assignment, which allows a malicious actor to trigger a service failure.

The vulnerability of Intel Graphics Driver drivers is related to the lack of checking for the value of the pointer before it is reassigned. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2020-8029

A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet key. This issue affects: SUSE CaaS Platform 4.5 skuba versions prior to https://github.com/SUSE/skuba/pull/1416...

CVE-2020-8029 skuba: Insecure handling of private key

A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet key. This issue affects: SUSE CaaS Platform 4.5 skuba versions prior to https://github.com/SUSE/skuba/pull/1416...

CVE-2020-8029

The CVE-2020-8029 entry concerns SUSE CaaS Platform 4.5 where the skuba component permits an Incorrect Permission Assignment for a Critical Resource, enabling local attackers to access the kublet key. Affected versions are skuba prior to the patch referenced by SUSE’s pull request #1416 (https://...

CVE-2020-26194

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to exploit the vulnerability, leading to compromised cryptographic...

CVE-2020-26194

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to exploit the vulnerability, leading to compromised cryptographic...

Design/Logic Flaw

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to exploit the vulnerability, leading to compromised cryptographic...

CVE-2020-26194

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 are affected by CVE-2020-26194, an Incorrect Permission Assignment for a Critical Resource vulnerability. A non-admin user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges could potentially exploit the issue to cause compromised crypt...

CVE-2020-26194

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to exploit the vulnerability, leading to compromised cryptographic...

The vulnerability of the user role management service in the Cisco DNA Center allows a hacker to execute arbitrary commands.

The vulnerability of the user role management service at the Cisco DNA Center is related to privilege assignment errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements

The Mozilla Foundation Security Advisory describes this flaw as: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash...

Security Advisory - Improper Permission Assignment Vulnerability in Huawei ManageOne Product

There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher privilege. Successful exploit could allow certain user to do certain operations with improper permission. Vulnerability ID: HWPSIRT-2020-8163...

Mozilla Firefox Type Obfuscation Code Execution Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A type confusion vulnerability exists in Mozilla Firefox when using the logical assignment operator, which prevents users from uploading files. No details of the vulnerability are provided at this time...