CVE-2018-2413

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2413: Missing Authorization

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-0195

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

Cisco IOS XE Software REST API Authorization Bypass Vulnerability

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: SecurEnvoy SecurMail vulnerable version: 9.1.501 fixed version: 9.2.501 or hotfix patch "1012018" CVE number: CVE-2018-7701,...

CVE-2018-2381

SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

PT-2018-15513

Name of the Vulnerable Software and Affected Versions SAP ERP Financials Information System versions 6.00 through 6.06, 6.16 SAP ERP Financials Information System version 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE versions 1.00 through 1.02 Description The issue results from insufficient authorization...

CVE-2017-1628

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

PT-2017-14366

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager version 8.6.0.0 Description The issue allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks. Recommendations For IBM Business Process Manager...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

CVE-2015-3419

vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...

Authorization

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks...

CVE-2015-3656

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks...

CVE-2015-3656

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks...

CVE-2015-3656

Aruba Networks ClearPass Policy Manager (CPPM) is affected by CVE-2015-3656. Vulnerability: remote authenticated lower-level administrators can escalate privileges due to failure to properly enforce authorization checks in CPPM versions before 6.4.7 and 6.5.x before 6.5.2. Impact: Privilege escal...

PT-2017-6693

Name of the Vulnerable Software and Affected Versions Aruba Networks ClearPass Policy Manager versions prior to 6.4.7 Aruba Networks ClearPass Policy Manager versions 6.5.x prior to 6.5.2 Description The issue allows remote authenticated lower-level administrators to gain privileges by leveraging...

Information Disclosure

Moodle is vulnerable to information disclosure. Authenticated attackers can read rating values to obtain sensitive information. This happens because it mishandles group-based authorization checks...

SAP Patches High-Risk Flaws in SAP POS, Host Agent

SAP fixed 23 vulnerabilities across roughly a dozen products on Tuesday, including a series of high-risk flaws that could allow an attacker to gain access to SAP POS, the company’s client/server point-of-sale PoS solution. The issues in SAP POS, a series of missing authorization checks, could let...

CVE-2017-4985

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attack...

CVE-2017-4985

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attack...