MGASA-2018-0414 Updated blueman packages fix security vulnerability

Flawed polkit authorization checks in blueman allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication boo1083066...

CVE-2018-12369

WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser permissions. This vulnerability affects Firefox ESR 60.1 and Firefox 61...

CVE-2018-0459

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who ...

Authorization

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who ...

CVE-2018-0459 Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who ...

CVE-2017-5658

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...

Authorization

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...

CVE-2017-5658

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...

SAP HCM Fiori People Profile GBX01 HR Privilege Vulnerability

SAP HCM Fiori People Profile GBX01 HR is a human resource management solution from SAP. An elevation of privilege vulnerability exists in SAP HCM Fiori People Profile GBX01 HR version 6.0, which can be exploited by an attacker to gain privileges due to a failure of the program to perform...

CVE-2018-2455

SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 in business function EAFSBCABUSOPRSEPA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2454

CVE-2018-2454 affects SAP Enterprise Financial Services versions 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0 in the function EAFS_BCA_BUSOPR_2 . The issue arises from missing authorization checks for an authenticated user, enabling an escalation of privileges. NVD reports CVSSv3.0 base score 8.8 (HIGH) ...

CVE-2018-2454

SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 in business function EAFSBCABUSOPR2 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

USN-3744-1 postgresql-10, postgresql-9.3, postgresql-9.5 vulnerabilities

Andrew Krasichkov discovered that the PostgreSQL client library incorrectly reset its internal state between connections. A remote attacker could possibly use this issue to bypass certain client-side connection security features. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...

CVE-2017-17707

Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely...

CVE-2017-17708

Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3...

CVE-2017-17707

The vulnerability CVE-2017-17707 affects Pleasant Password Server prior to version 7.8.3. Due to missing authorization checks, any authenticated user can list, upload, or delete attachments to password safe entries if they know the corresponding CredentialId (a GUID). Exposure can occur when an e...

CVE-2017-17707

Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely...

CVE-2018-2436

Executing transaction WRCK in SAP R/3 Enterprise Retail EHP6 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2436

Executing transaction WRCK in SAP R/3 Enterprise Retail EHP6 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

Security Bulletin: Multiple vulnerabilities in IBM Business Process Manager shipped with IBM Cloud Orchestrator and IBM SmartCloud Orchestrator

Summary IBM Business Process Manager is shipped as a component of IBM Cloud Orchestrator, IBM Cloud Orchestrator Enterprise, IBM SmartCloud Orchestrator, and IBM SmartCloud Orchestrator Enterprise. Vulnerability Details Review the following security bulletins for IBM Business Process Manager for...