CVE-2020-4762

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.52, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896...

CVE-2020-4762

CVE-2020-4762 affects IBM Sterling B2B Integrator: Standard Edition 5.2.0.0–5.2.6.5_2, 6.0.0.0–6.0.3.2, and 6.1.0.0. The issue is an improper access control that could allow an authenticated user to create a privileged account, i.e., elevation of privilege. IBM Security Bulletin confirms the vuln...

Red Lion Controls Crimson 访问控制错误漏洞

Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...

CVE-2020-4919

IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395...

CVE-2020-4919

IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395...

CVE-2020-4919

CVE-2020-4919 affects IBM Cloud Pak System 2.3, where insufficient logout controls can let an authenticated privileged user impersonate another user. Root cause: inadequate session/logout handling on the system. The entry is supported by multiple sources (NVD/CVE, CNVD/Prion) indicating the same ...

CVE-2020-4919

IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395...

Insecure Access Controls

Xen is vulnerable to denial of service. Unprivileged guest users are able to obtain and modify permissions, list and delete root nodes. This is due to permissions that are not properly enforced...

Authorization Bypass

bolt/bolt is vulnerable to authorization bypass. The filter options in a Request in the Twig context is not restricted and allows an attacker to bypass access controls...

Privilege Escalation

odoo is vulnerable to privilege escalation. Insecure access controls allows remote authenticated users with access to contact management to modify user accounts, resulting in the attacker obtaining higher privileges...

Information Disclosure

odoo is vulnerable to information disclosure. Insecure access controls in mail module notifications allows remote authenticated users to obtain access to arbitrary messages in conversations that are otherwise restricted...

The vulnerability of the PFileSystemRequestConstructor function in browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows for bypassing access control to the file system in the shell environment, enabling attackers to gain access to protected information.

The vulnerability of the PFileSystemRequestConstructor function in browsers such as Firefox, Firefox ESR, and the email client Thunderbird relates to bypassing access controls for the file system in the shell. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain...

Acronis: HTTP Request Smuggling on https://promosandbox.acronis.com

Summary The website https://promosandbox.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...

TAU Threat Analysis: Insights on the SolarWinds Breach

In light of the SolarWinds breach, we want to help our customers who may have questions as well as the larger security community. The VMware Carbon Black Threat Analysis Unit TAU has been steadfastly monitoring the evolving situation as we learn more about the supply chain compromise. We caught u...

Build a Secure Well-Architected Cloud Environment

Explore the Security pillar of the AWS and Azure Well-Architected Framework and be guided through the fundamental security controls that should be addressed when designing, transitioning to, and operating in a cloud environment...

CVE-2020-27199

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...

CVE-2020-35122

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could bypass the access controls for using a saved database connection profile to submit arbitrary SQL against a saved database connection...

CVE-2020-35122

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could bypass the access controls for using a saved database connection profile to submit arbitrary SQL against a saved database connection...

Design/Logic Flaw

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could bypass the access controls for using a saved database connection profile to submit arbitrary SQL against a saved database connection...

CVE-2020-35122

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could bypass the access controls for using a saved database connection profile to submit arbitrary SQL against a saved database connection...