Cisco Connected Grid Network Management System SQL Injection Vulnerabilities

A vulnerability in device management of the Cisco Connected Grid Network Management System CG-NMS could allow an unauthenticated, remote attacker to modify data in the CG-NMS database by using SQL injection. The vulnerability is due to insufficient input validation. An attacker could exploit this...

Multiple Cisco Products Root Shell Access Vulnerability

Multiple Cisco products contain a vulnerability that could allow a local attacker to gain shell access with root privileges. The vulnerability is due to incorrect validation of user-supplied input processed by the command-line interface CLI on Cisco products running the affected software. A local...

USN-1668-1: Apport update

Dan Rosenberg discovered that an application running under an AppArmor profile that allowed unconfined execution of apport-bug could escape confinement by calling apport-bug with a crafted environment. While not a vulnerability in apport itself, this update mitigates the issue by sanitizing certa...

CVE-2012-4457

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant...

CentOS Update for abrt CESA-2012:0841 centos6

Check for the Version of abrt OpenVAS Vulnerability Test CentOS Update for abrt CESA-2012:0841 centos6 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CVE-2012-1122

bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...

CVE-2012-1118

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

Code injection

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1122

bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...

CVE-2012-1118

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1118

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1122

bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...

CVE-2012-1118

CVE-2012-1118 affects MantisBT before 1.2.9; the access_has_bug_level check fails when private_bug_view_threshold is an array, allowing bypass of private bug view restrictions and enabling certain operations on private bug reports. The description notes the vulnerability and its impact on access ...

PT-2012-3092

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns the SOAP API in MantisBT, where it fails to properly enforce certain permissions, specifically bugnote allow user edit delete and delete bug threshold. This allows remote...

PT-2012-3094

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns a permission checking flaw in bug actiongroup.php. This flaw allows remote authenticated users with certain privileges to bypass access restrictions and move bug reports to...

CVE-2012-1118: Undefined Security Weakness

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...