CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a projec...

PT-2019-13936

Name of the Vulnerable Software and Affected Versions Jira versions prior to 7.13.12 Jira versions 8.0.0 through 8.4.3 Jira versions 8.5.0 through 8.5.2 Description The issue is related to a missing authorization check in the removeStatus method of the WorkflowResource class. This allows...

Authorization

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the...

CVE-2019-15005

The CVE-2019-15005 vulnerability concerns the Atlassian Troubleshooting and Support Tools (ATST) plugin prior to version 1.17.2, which is bundled with multiple Atlassian products. An unprivileged user can initiate periodic log scans and have the results emailed to a user-specified address due to ...

PT-2019-13930

Name of the Vulnerable Software and Affected Versions Atlassian Troubleshooting and Support Tools plugin versions prior to 1.17.2 Bitbucket Server / Data Center versions prior to 6.6.0 Confluence Server / Data Center versions prior to 7.0.1 Jira Server / Data Center versions prior to 8.3.2 Crowd ...

CVE-2019-5533

Summary: CVE-2019-5533 affects VMware SD-WAN by VeloCloud Orchestrator (3.x, before 3.3.0). A parameter authorization check allows an enterprise user to disclose MSP account information. Impact (per sources): Information disclosure limited to MSP user data (username, first/last name, phone, email...

CVE-2019-5533

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail addre...

CVE-2019-0367

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

Authorization

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

CVE-2019-0367

CVE-2019-0367 affects SAP NetWeaver Process Integration (B2B Toolkit) prior to versions 1.0 and 2.0. The root cause is missing authorization checks for an authenticated user, enabling the import of B2B table content and leading to a Missing Authorization Check. Publicly available connected docume...

CVE-2019-0367

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

PT-2019-4330

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration B2B Toolkit versions prior to 1.0 and 2.0 Description The issue is related to missing authorization checks for authenticated users, allowing the import of B2B table content. This can lead to a Missing...

Atlassian JIRA < 8.3.2 Multiple Vulnerabilities

According to its self-reported version number, The version of Atlassian JIRA hosted on the remote web server is 7.6 8.3.2. It is therefore affected by the following vulnerabilities: - An incorrect authorization check on the /rest/issueNav/1/issueTable resource in Jira allows remote attackers to...

Improper Authorization in Bambooo through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Bamboo before version 6.10.2, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email...

Improper Authorization in Fisheye & Crucible through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Fisheye & Crucible before version 4.7.2, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. Th...

Improper Authorization in Crowd through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Crowd & Crowd Data Center before version 3.6.0, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization...

Improper Authorization in Jira Server through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Jira Server & Jira Data Center before version 8.3.2, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorizati...

CVE-2019-16723

CVE-2019-16723 affects Cacti until 1.2.6. An authenticated user can bypass authorization to view a graph by calling graph_json.php with a modified local_graph_id, effectively an IDOR-style flaw. Remediation per connected sources is to upgrade to a fixed release (examples include Cacti 1.2.9+; som...

DEBIAN-CVE-2019-16236

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala...

WordPress WP Social Feed Gallery plugin <= 2.4.7 - Authorization Check vulnerability

Authorization Check vulnerability found in WordPress WP Social Feed Gallery plugin versions = 2.4.7. Solution Update the WordPress WP Social Feed Gallery plugin to the latest available version at least 2.4.8...