CVE-2018-11192: Incorrect Permission Assignment for Critical Resource

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 4 of 6...

CVE-2018-11194: Incorrect Permission Assignment for Critical Resource

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 6 of 6...

CVE-2018-1370: Incorrect Permission Assignment for Critical Resource

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

Unauthorised Downloads

Moodle is vulnerable to unauthorised downloads. It is possible because any authorized student with access to portfolio assignment caller class can change the download URL to download any files...

UBUNTU-CVE-2018-1134

An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL...

Code injection

An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL...

The vulnerability of the Intel Graphics Driver lies in a pointer swapping error, which allows attackers to escalate their privileges.

The vulnerability of the Intel Graphics Driver lies in a pointer assignment error. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Calamp.com Incorrect Privilege Assignment

There is also a full write up on https://medium.com/@evstykas/remote-smart-car-hacking-with-just-a-phone-2fe7ca682162 Vulnerability Security Advisory ======================================================================= title: Incorrect Privilege Assignment product: lenderoutlook on...

CVE-2018-1115: Incorrect Permission Assignment for Critical Resource

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

Microsoft Windows 10: Back up files and directories

This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface API...

Microsoft Windows 10: Restore files and directories

This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object. OpenVAS Vulnerability Test $Id:...

Microsoft Windows 10: Allow log on through Remote Desktop Services

This policy setting determines which users or groups can access the logon screen of a remote device through a Remote Desktop Services connection. It is possible for a user to establish a Remote Desktop Services connection to a particular server but not be able to log on to the console of that sam...

Microsoft Windows 10: Create global objects

This policy setting determines which users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. A global object is an object that is created to be used by any number of processes or...

Microsoft Windows 10: Act as part of the operating system

The Act as part of the operating system policy setting determines whether a process can assume the identity of any user and thereby gain access to the resources that the user is authorized to access. OpenVAS Vulnerability Test $Id: win10actaspartofos.nasl 11532 2018-09-21 19:07:30Z cfischer $ Che...

Microsoft Windows 10: Debug programs

This policy setting determines which users can attach to or open any process, even those they do not own. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components need this user right. This user right provid...

Microsoft Windows 10: Access Credential Manager as a trusted caller

The Access Credential Manager as a trusted caller policy setting is used by Credential Manager during backup and restore. No accounts should have this privilege because it is assigned only to the Winlogon service. Saved credentials of users may be compromised if this privilege is given to other...

Microsoft Windows 10: Deny log on through Remote Desktop Services

This policy setting determines which users are prevented from logging on to the device through a Remote Desktop connection through Remote Desktop Services. It is possible for a user to establish a Remote Desktop connection to a particular server, but not be able to log on to the console of that...

CVE-2018-5342: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

Product update: Virtuozzo 7.0 Update 7 Hotfix 1 (7.0.7-445)

The Hotfix 1 for Virtuozzo 7.0 Update 7 provides stability and usability bug fixes. Vulnerability id: PSBM-82558 Container migration could sometimes fail due to a CRIU issue. Vulnerability id: PSBM-82711 'prlctl qemu-update' could fail due to unnamed dirty bitmaps. This could result in backups no...

The vulnerability of the Linux operating system’s i8042 controller driver allows a hacker to cause a service failure or exert other effects.

The vulnerability of the i8042 controller driver drivers/input/serio/i8042.c in the Linux operating system is related to a pointer assignment error. Exploiting this vulnerability could allow an attacker to cause a service failure or other adverse effects...