GitLab EE Authorization Issues Vulnerability (CNVD-2019-42743)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab EE...

CVE-2018-19569

GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization flaw that lets a user access the web UI using a Personal Access Token of any scope. The root cause is an authorization issue that improperly permits PAT-authenticat...

CVE-2019-5981

Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with administrative privilege via unspecified vectors...

Multiple ZOHO Products License Issue Vulnerabilities

ZOHO ManageEngine Desktop Central DC and so on are the products of the United States ZhuoHao ZOHO company.ManageEngine Desktop Central is a set of desktop management solutions.ZOHO ManageEngine ServiceDesk Plus is a set of ITIL architecture based on IT service management software ITSM.ZOHO...

Cisco IOS XR Authorization Issues Vulnerability

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR is vulnerable to an authorization issue. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a network system or...

GitLab Authorization Issues Vulnerability (CNVD-2019-43039)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab. Th...

Authorization

ABAP BASIS function modules INSTCREATER3RFCDEST, INSTCREATETCPIPRFCDEST, and INSTCREATETCPIPRFCDEST in SAP BASIS fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53 do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in...

IBM InfoSphere Information Server Authorization Issues Vulnerability

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. An authorization issue vulnerability exists in IBM InfoSphere Information Server. The vulnerability arises...

CVE-2019-10040

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

Authorization

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability tha...

CVE-2018-1000418

CVE-2018-1000418 affects Jenkins HipChat Plugin (versions ≤ 2.2.0). The HipChatNotifier.java improper authorization allows users with Overall/Read access to trigger test notifications to an attacker-controlled HipChat server using attacker-specified credential IDs, enabling capture of credentials...

Amazon Linux AMI : postgresql95 (ALAS-2018-1118)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

Authorization

The Dell OpenManage Network Manager virtual appliance versions prior to 6.5.3 contain an improper authorization vulnerability caused by a misconfiguration in the /etc/sudoers file...

Authorization

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials...

CVE-2018-7363

ZTE ZXHN F670 devices with firmware versions up to 1.1.10P3T18 are affected by an improper authorization vulnerability. The appviahttp service has no authorization delay, allowing brute‑force credential attempts. Connected records confirm affected versions and brute‑force risk; no exploit details...

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite and SIMATIC IT UA Discrete Manufacturing License Issue Vulnerabilities

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite, and SIMATIC IT UA Discrete Manufacturing are products of Siemens, Germany.Siemens SIMATIC IT LMS is a line monitoring system for overall equipment effectiveness OEE. Siemens SIMATIC IT LMS is a line monitoring system for Overall Equipment...

CloudBees Jenkins Authorization Issues Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

Nextcloud Server Authorization Issues Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. An authorization issue vulnerability exists in Nextcloud Server. An attacker could exploit the vulnerability to obtain ...

Dogtag PKI has an unspecified vulnerability

Dogtag PKI is an enterprise-grade open source certificate authority system. The system supports features such as key archiving, OCSP Online Certificate Status Management and smart card management. A security vulnerability exists in the AAclAuthz.java file in Dogtag PKI 10.6.1 and earlier versions...

CVE-2017-3960

The CVE-2017-3960 entry relates to McAfee Network Security Management (NSM) web interface: an authorization vulnerability that lets authenticated users gain elevated privileges via a crafted HTTP request parameter. Affected product: NSM web interface prior to version 8.2.7.42.2. Root cause: impro...