Wowza Media Systems Streaming Engine Permission License and Access Control Issues Vulnerability

Wowza Media Systems Streaming Engine is a suite of streaming media server software from Wowza Media Systems in the United States. A privilege-granting and access-control issue vulnerability exists in Wowza Media Systems Streaming Engine 4.8.5 and earlier versions, which stems from a file-permissi...

PT-2021-2855 · Oracle · Oracle Database

Name of the Vulnerable Software and Affected Versions: Oracle Database - Enterprise Edition versions 12.1.0.2 through 19c Description: The issue is related to inadequate access control in the Oracle Database - Enterprise Edition component of Oracle Database Server. It allows a high-privileged...

Mozilla Firefox 权限许可和访问控制问题漏洞

Mozilla Firefox is an open source web browser. A security vulnerability exists in Mozilla Firefox, which can be exploited by remote attackers using test code to enable session history manipulation...

CVE-2020-29592

An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed regardless of the file types allowed list in Media settings...

Microsoft Windows NTFS 权限许可和访问控制问题漏洞

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in NTFS in Microsoft Windows and Windows...

Microsoft Win32k 权限许可和访问控制问题漏洞

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Win32k in Microsoft Windows and Windows...

Microsoft Diagnostics Hub Standard Collector Service 权限许可和访问控制问题漏洞

Microsoft Diagnostics Hub Standard Collector Service is a Win32 service from Microsoft USA. It is used to collect real-time ETW events and process them. Microsoft Diagnostics Hub Standard Collector Service is vulnerable to privilege permission and access control issues...

SIEMENS DIGSI 4 Privilege License and Access Control Issues Vulnerability

SIEMENS DIGSI 4 is a driver from SIEMENS USA. Provides device driver functionality. A privilege license and access control issue vulnerability exists in SIEMENS DIGSI 4. The vulnerability stems from the fact that several folders in \%PATH\% can be written to by a normal user, and can be exploited...

OTRS OTRS 权限许可和访问控制问题漏洞

OTRS is an application from the German company OTRS. A service management software. A security vulnerability exists in OTRS that originates from viewing a linked FAQ article without a license...

PT-2021-9684 · Unknown · Soplanning

Name of the Vulnerable Software and Affected Versions: SOPlanning versions prior to 1.47 Description: The issue is related to incorrect access control due to public secret key information and its related authentication algorithm. Specifically, the key for the admin account is hardcoded in the...

NETGEAR JGS516PE/GS116Ev2 Buffer Overflow Vulnerability

The NETGEAR JGS516PE/GS116Ev2 is a 16-port Gigabit Smart Managed Plus switch. A buffer overflow vulnerability exists in the access control section of the NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43. An attacker can exploit this vulnerability by injecting IP addresses into a whitelist via the...

PT-2021-2277 · Microsoft · Windows 10 Update Assistant +1

Name of the Vulnerable Software and Affected Versions: Windows 10 Update Assistant affected versions not specified Description: The issue is related to improper access control in the Windows Update Assistant, which can be exploited to elevate privileges. This could allow an attacker to affect the...

PT-2021-15234 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 2.4.21 through 2.20.23 GitHub Enterprise Server versions 2.21.0 through 2.21.14 GitHub Enterprise Server versions 2.22.0 through 2.22.6 GitHub Enterprise Server versions 3.0.0 Description: An improper access...

OTRS AG OTRSCIsInCustomerFrontend Permission License and Access Control Issues Vulnerability

OTRS AG OTRSCIsInCustomerFrontend is a management system from OTRS USA. It provides modern, flexible ticket and process management services. A privilege permission and access control issue vulnerability exists in OTRS AG OTRSCIsInCustomerFrontend, which stems from an agent being able to view and...

PT-2021-2307 · Adobe · Acrobat +1

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader DC versions 2020.013.20074 and earlier Adobe Acrobat Reader DC versions 2020.001.30018 and earlier Adobe Acrobat Reader DC versions 2017.011.30188 and earlier Adobe Acrobat versions prior to the fixed version Description:...

Backblaze Permission License and Access Control Issues Vulnerability

Backblaze is a cloud backup service from Backblaze, Inc. in the United States. A privilege permission and access control issue vulnerability exists in Backblaze for Windows and Backblaze for macOS prior to version 7.0.0.439, which stems from a lack of privilege handling and validation prior to th...

CVE-2020-26176

An issue was discovered in tangro Business Workflow before 1.18.1. No or broken access control checks exist on the /api/document//attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to...

NZXT CAM 权限许可和访问控制问题漏洞

NZXT CAM is a performance monitoring software for gaming computers from NZXT USA. The software can be used to manage computer performance, temperature, and devices to ensure that the computer is at optimal performance. NZXT CAM 4.8.0 suffers from a Privilege Permission and Access Control Issues...

Trend Micro Apex One and OfficeScan XG Incorrect Access Control Information Disclosure Vulnerability (CNVD-2020-73779)

Trend Micro Apex One is a suite of endpoint security protection software from Trend Micro that provides automated threat detection and response capabilities.Trend Micro OfficeScan XG is a suite of distributed anti-virus software from Trend Micro. An incorrect access control information disclosure...

Code injection

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...