CVE-2020-6188

VAT Pro-Rata reports in SAP ERP SAPAPPL versions 600, 602, 603, 604, 605, 606, 616 and SAPFIN versions 617, 618, 700, 720, 730 and SAP S/4 HANA versions 100, 101, 102, 103, 104 do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check...

PT-2020-18991

Name of the Vulnerable Software and Affected Versions SAP APPL versions 600 through 606, 616 SAP FIN versions 617 through 618, 700, 720, 730 SAP S/4 HANA versions 100 through 104 Description The issue is related to Missing Authorization Check in VAT Pro-Rata reports. This occurs because the repor...

CVE-2020-6188: Missing Authorization

VAT Pro-Rata reports in SAP ERP SAPAPPL versions 600, 602, 603, 604, 605, 606, 616 and SAPFIN versions 617, 618, 700, 720, 730 and SAP S/4 HANA versions 100, 101, 102, 103, 104 do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check...

PT-2020-18986

Name of the Vulnerable Software and Affected Versions SAP Host Agent version 7.21 Description The issue allows an unprivileged user to read or write to the shared memory by sending a request to the main SAPOSCOL process. This can lead to the user receiving responses that contain data read with ro...

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwpmmbsetrequest in init.php. Any attacker who knows the username of an administrator can log in...

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwpmmbsetrequest in init.php. Any attacker who knows the username of an administrator can log in...

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwpmmbsetrequest in init.php. Any attacker who knows the username of an administrator can log in...

CVE-2020-8772

The CVE-2020-8772 entry concerns the WordPress InfiniteWP Client plugin prior to 1.9.4.5, which contains a missing authorization check in iwp_mmb_set_request (init.php). Exploitation allows an attacker who knows an administrator’s username to log in as that user, enabling access to sensitive info...

Information leak through broken access control in Jira Server and Data Center - CVE-2019-20407

The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check...

Improper Authorization in Applinks - CVE-2019-20105

The Application links plugin used in Atlassian Jira Server and Data Center before version 7.13.12, from version 8.0.0 before version 8.5.4 and from version 8.6.0 before version 8.6.1 allows remote attackers with administrator privileges to edit existing applinks without passing WebSudo via an...

Improper Authorization in Applinks - CVE-2019-20105

The Application links plugin used in Atlassian Jira Server and Data Center before version 7.13.12, from version 8.0.0 before version 8.5.4 and from version 8.6.0 before version 8.6.1 allows remote attackers with administrator privileges to edit existing applinks without passing WebSudo via an...

HackerOne: Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects

The Checklist objects that can be queried through GraphQL are supposed to only be accessible by program members, the users who claimed or responded to a check belonging to a checklist, and HackerOne Pentesters. The Checklist object is also supposed to be in the running state e.g. when the platfor...

HackerOne: HackerOne Pentesters can access any structured scope object through GraphQL node interface

A missing authorization check in the StructuredScope protector class app/protectors/protectedstructuredscope.rb:42 enables any HackerOne Pentester to access structured scope objects of programs they aren't invited to or aren't running a penetration test through HackerOne. ruby class...

CVE-2020-6306

Missing authorization check in a transaction within SAP Leasing update provided in SAPAPPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17...

CVE-2020-6306

CVE-2020-6306 affects SAP Leasing components. Reports show a missing authorization check in a transaction, allowing an attacker to bypass security restrictions. Affected SAP Leasing versions include 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, and 6.18. The issue is tied to insufficient access ...

PT-2020-1567

Name of the Vulnerable Software and Affected Versions SAP Leasing versions prior to 6.18 EA-APPL versions 6.0 through 6.06, 6.16, and 6.17 Description The issue is related to a missing authorization check in a transaction within SAP Leasing. This could potentially allow a remote attacker to eleva...

InfiniteWP Client < 1.9.4.5 - Authentication Bypass

As per agreement between the researcher and developer, details will be released on January 14th. It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwpmmbsetrequest which is located in the init.php file. This checks if t...

Atlassian JIRA < 7.13.12 / 8.x < 8.4.3 / 8.5.x < 8.5.2 Authorization Bypass (JRASERVER-70405)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.12, 8.x prior to 8.4.3, or 8.5.x prior to 8.5.2 / 8.6.0. It is, therefore, affected by an authorization bypass vulnerability. The vulnerability exists in the...

Security Bulletin: Security vulnerabilities in IBM Java Runtime affect IBM License Key Server Administration and Reporting Tool and Agent

Summary There are multiple vulnerabilities related to IBM® Runtime Environment Java™ Technology Edition which is used and shipped by different versions of IBM License Key Server Administration and Reporting Tool ART and Agent. Vulnerability Details CVEID: CVE-2019-2933 DESCRIPTION: An unspecified...

CVE-2019-15013

CVE-2019-15013 affects Atlassian Jira. The issue is in the WorkflowResource.removeStatus path, allowing authenticated remote attackers who do not have project administration access to remove a configured issue status from a project due to a missing authorization check. Affected versions include J...