PT-2018-14295

Name of the Vulnerable Software and Affected Versions eDirectory versions prior to 9.1 SP2 Description The issue is related to incorrect enforcement of authorization checks. Recommendations For versions prior to 9.1 SP2, update to version 9.1 SP2 or later to resolve the issue...

HackerOne: Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report

Hi Hackerone team, I am still able to access other program details etc. when i'm authenticated to HackerOne through SAML . I'm not sure if it's the same bug i reported earlier or there is some weak authorization check in place. PFA for more info i can access related to ██████████ etc. See the dat...

Authorization

The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization chec...

CVE-2018-19110

The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization chec...

CVE-2018-19110

The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization chec...

SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:3377-1)

This update for postgresql96 to 9.6.10 fixes the following issues : These security issues were fixed : CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with 'host' or 'hostaddr' connection parameters from untrusted...

CVE-2018-11785

Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query...

CVE-2018-11785

CVE-2018-11785 affects Apache Impala versions prior to 3.0.1 where a missing authorization check allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, resulting in incorrect query results. The connected CNVD/OSV/NVD records corroborate the lack of autho...

CVE-2018-11785

Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query...

PT-2018-10819

Name of the Vulnerable Software and Affected Versions Apache Impala versions prior to 3.0.1 Description The issue is related to a missing authorization check, allowing a Kerberos-authenticated but unauthorized user to inject random data into a running query. This can lead to incorrect results for...

CVE-2018-15405

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

CVE-2018-15405 Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

CVE-2018-15405 Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

CVE-2018-15405

CVE-2018-15405 affects Cisco IMC Supervisor and Cisco UCS Director web interfaces. The root cause is an authorization check that fails to include the user’s access level, allowing an authenticated attacker with valid credentials to send crafted HTTP requests and view sensitive information belongi...

Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

CVE-2018-2461

CVE-2018-2461 affects SAP HCM Fiori People Profile GBX01 HR 6.0. The vulnerability is due to a missing authorization check, enabling an authenticated user to escalate privileges. Public sources (NVD/CNVD) corroborate a privilege-elevation issue in this component. Severity: CVSSv3 base score 8.8 (...

CVE-2018-2461

Missing authorization check in SAP HCM Fiori "People Profile" GBX01 HR version 6.0 for an authenticated user which may result in an escalation of privileges...

Security update for postgresql10 (moderate)

This update for postgresql10 fixes the following issues: PostgreSQL 10 was updated to 10.5: - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-10-5.html A dump/restore is not required for those running 10.X. However, if you use the adminpack...

openSUSE Security Update : postgresql10 (openSUSE-2018-955)

This update for postgresql10 fixes the following issues : PostgreSQL 10 was updated to 10.5 : - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-10-5.html A dump/restore is not required for those running 10.X. However, if you use the adminpack...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PostgreSQL vulnerabilities (USN-3744-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3744-1 advisory. Andrew Krasichkov discovered that the PostgreSQL client library incorrectly reset its internal state between connections. A remot...