CVE-2018-2419

CVE-2018-2419 concerns SAP Enterprise Financial Services (SAPSCORE 1.11/1.12; S4CORE 1.01/1.02; EA-FINSERV 6.x, 8.0) where an authenticated user can escalate privileges due to missing authorization checks. The description and related sources corroborate a privilege-escalation flaw without detaili...

CVE-2018-2419

SAP Enterprise Financial Services SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

SAP Disclosure Management Elevation of Privilege Vulnerability

SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A security vulnerability exists in SAP Disclosure Management version 10.1, which stems...

SAP Disclosure Management elevation of privilege vulnerability (CNVD-2018-08888)

SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A security vulnerability exists in SAP Disclosure Management version 10.1, which stems...

CVE-2018-2413

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2413

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2412

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

Authorization

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

Authorization

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2412

CVE-2018-2412 – SAP Disclosure Management 10.1 : The issue is that the product does not perform necessary authorization checks for an authenticated user, enabling escalation of privileges. The primary impact stated in the sources is elevated access within the application, with CVSS metrics indica...

CVE-2018-2413

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2413: Missing Authorization

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-0195

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

Cisco IOS XE Software REST API Authorization Bypass Vulnerability

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: SecurEnvoy SecurMail vulnerable version: 9.1.501 fixed version: 9.2.501 or hotfix patch "1012018" CVE number: CVE-2018-7701,...

CVE-2018-2381

SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2017-1628

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

CVE-2015-3419

vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...

CVE-2015-3656

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks...