5593 matches found
CVE-2018-11642
CVE-2018-11642 affects Dialogic PowerMedia XMS (3.5 and earlier). The flaw is an incorrect privilege assignment in the /var/www/xms/cleanzip.sh shell script that runs periodically, enabling a local attacker to execute code with root privileges. Connected documents corroborate the local-privation ...
CVE-2018-11642
Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows local users to execute code as the root user...
CVE-2018-11642: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows local users to execute code as the root user...
TP-Link TL-WR841N V13 Cross Site Request Forgery Vulnerability
Exploit for hardware platform in category web applications Vulnerability: Cross-Site Request Forgery Affected Software: TP-Link TL-WR841N v13 Affected Version: 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n Patched Version: None Overview The web interface of the router is vulnerable to CSRF. An...
CVE-2018-12615: Incorrect Permission Assignment for Critical Resource
An issue was discovered in switchGroup in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups gidset is not set correctly, leaving it up to randomness i.e., uninitialized memory which supplementary groups are actually being set while lowering privileges...
CVE-2018-0293
A vulnerability in role-based access control RBAC for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials for the device. The vulnerability is d...
Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2017-1624)
Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVEID: CVE-2017-1624 DESCRIPTION: IBM QRadar specifies permissions for a security-critical resource in a way that allow...
Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-9722)
Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVE-ID: CVE-2016-9722 Description: IBM QRadar specifies permissions for a security-critical resource in a way that allo...
Security Bulletin: Incorrect Permission Assignment for Critical Resource vulnerability affects IBM Security Guardium (CVE-2017-1266 )
Summary IBM Security Guardium specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM Security Guardium has provided a fix for this vulnerability. Vulnerability Details CVEID: CVE-2017-1266 DESCRIPTION: IBM Securit...
Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-2877)
Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVE-ID: CVE-2016-2877 Description: IBM QRadar could allow a local user to write files to certain web accessible...
WordPress Tooltipy 5.0 Cross Site Scripting
Details ================ Software: Tooltipy tooltips for WP Version: 5.0 Homepage: https://wordpress.org/plugins/bluet-keywords-tooltip-generator/ Advisory report: https://advisories.dxw.com/advisories/xss-in-tooltipy/ CVE: Awaiting assignment CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N...
CVE-2017-7821: Incorrect Permission Assignment for Critical Resource
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those...
CVE-2018-4251: Incorrect Permission Assignment for Critical Resource
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Firmware" component. It allows attackers to modify the EFI flash-memory region that a crafted app that has root access...
CVE-2012-0433: Incorrect Permission Assignment for Critical Resource
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...
CVE-2018-4220: Incorrect Permission Assignment for Critical Resource
An issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is affected. The issue involves the "Swift for Ubuntu" component. It allows attackers to execute arbitrary code in a privileged context because write and execute permissions are enabled during library...
CalAmp lenderoutlook on colt.calamp-ts.com incorrect privilege assignment vulnerability
Calamp is a pioneer in M2M telematics, managing over 1.5M IoT devices. An incorrect privilege assignment vulnerability exists in CalAmp lenderoutlook on colt.calamp-ts.com. An attacker could exploit the vulnerability to obtain sensitive data...
GE MDS PulseNET Account Java RMI Incorrect Privilege Assignment Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE MDS PulseNET. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the...
CVE-2017-18285: Incorrect Permission Assignment for Critical Resource
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...
CVE-2017-18284: Incorrect Permission Assignment for Critical Resource
The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...