Cisco Prime Collaboration Provisioning Authorization Issues Vulnerability

Cisco Prime Collaboration Provisioning PCP is a set of Web-based, next-generation communications services software from Cisco. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. An authorization issue vulnerability exists ...

Authorization

Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered...

CVE-2018-1278

Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered...

CVE-2018-1278

Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered...

PT-2018-25: Improper Authorization in PRTG Network Monitor

The specialists of the Positive Research center have detected an Improper Authorization vulnerability in PRTG Network Monitor. Vulnerability due to improper validation of user rights allows attackers with read-only privileges to create users with read-write privileges including administrators via...

CVE-2018-7245

An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server Port 80/443/TCP of the affected devices could allow a remote attacker to change UPS control and shutdown parameters or...

Authorization

S12700 V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R007C20, V200R008C00, V200R008C06, V200R009C00, V200R010C00, S7700 V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R008C00, V200R008C06, V200R009C00...

CVE-2017-1766

Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151...

CVE-2015-7463

IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393...

CVE-2018-1000105

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...

CVE-2017-17323

Huawei iBMC V200R002C10; V200R002C20; V200R002C30 have an improper authorization vulnerability. The software incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by admin user. Successful exploit could cause...

Authorization Bypass

saml-client is vulnerable to authorization bypass attacks. The library uses a vulnerable version of the of the Shibboleth xmltooling library, causing text after a comment being lost before signing the SAML Message. This allows a malicious user to modify a SAML message without invalidating the...

CVE-2018-1000110

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users...

IBM Security Guardium Database Activity Monitor Authorization Vulnerability

IBM Security Guardium Database Activity Monitor is a database activity monitor product from IBM USA. The product provides features such as automated controls for compliance and protection against internal and external threats. An authorization vulnerability exists in IBM Security Guardium Databas...

CVE-2017-18095

CVE-2017-18095 affects Atlassian Crucible prior to 4.5.1 and prior to 4.6.0. The vulnerability is an improper authorization that allows remote attackers to comment on snippets they should not access. A fix exists in the 4.5.x series (4.5.1+) and in 4.6.0+. Organizations using Crucible should upgr...

CVE-2018-1000022

CVE-2018-1000022 affects Electrum Bitcoin Wallet versions prior to 3.0.5, where a Missing Authorization vulnerability in the JSONRPC interface could lead to bitcoin theft if the wallet is not password protected. The issue is exploitable when a user visits a page with specially crafted JavaScript....

CVE-2018-1000022

Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password protected. This attack appear to be exploitable via The victim must visit a...

CVE-2017-12118

CVE-2017-12118 refers to a vulnerability in cpp-ethereum’s JSON‑RPC miner_stop API where improper authorization could allow a remote attacker to trigger functionality reserved for admins. The weakness stems from missing privilege checks in miner_stop (no RPC_ADMIN guard), with attacker-controlled...

CVE-2017-8192

FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation...

CVE-2017-8196

CVE-2017-8196 is described in Huawei’s Huawei-PSIRT advisory HWPSIRT-2017-06166 as an incorrect authorization vulnerability in Huawei FusionSphere, affecting FusionSphere V100R006C00SPC102 (NFV). An authenticated attacker could execute commands they should not have permission for, enabling queryi...