138 matches found
CVE-2020-10669
The Canon Oce Colorwave 500 printer web interface (version 4.0.0.0) is affected by CVE-2020-10669 due to an authentication bypass on /home.jsp. An unauthenticated attacker who can reach the device’s web UI can obtain copies of documents uploaded by users. The issue is confirmed in multiple source...
CVE-2020-10669
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...
CVE-2019-8770
The issue was addressed with improved permissions logic. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to access recent documents...
CVE-2019-14251
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer to traverse the file system and access files or directories that are...
Cloudera CDH Cloudera Search Unauthorized Access Vulnerability
Cloudera CDH is an open source Hadoop platform from Cloudera. The platform provides scalable storage and distributed computing, as well as a Web-based user interface and other enterprise features.Cloudera Search is a program for ... A security vulnerability exists in Cloudera Search in versions o...
CVE-2016-6353
Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler...
eMerge E3 1.00-06 - Unauthenticated Directory Traversal
eMerge E3 1.00-06 - Unauthenticated Directory Traversal Exploit Title: eMerge E3 1.00-06 - Unauthenticated Directory Traversal Google Dork: NA Date: 2018-09-11 Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link:...
CVE-2018-16656
DoBoxCstmBoxInfo.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP request...
Design/Logic Flaw
DoBoxCstmBoxInfo.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP request...
CVE-2018-16656
DoBoxCstmBoxInfo.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP request...
IBM StoredIQ Elevation of Privilege Vulnerability
IBM StoredIQ is a suite of data visualization and processing platforms from IBM, USA. The platform provides scalable analytics and governance of unstructured data, as well as records management, storage optimization and migration of data. A security vulnerability exists in IBM StoredIQ version 7....
CVE-2018-10207
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and export files that should have been restricted, via vectors involving page-by-page access to a document in SWF format...
CVE-2017-0423
An elevation of privilege vulnerability in Bluetooth could enable a proximate attacker to manage access to documents on the device. This issue is rated as Moderate because it first requires exploitation of a separate vulnerability in the Bluetooth stack. Product: Android. Versions: 5.0.2, 5.1.1,...
UBUNTU-CVE-2017-0423
An elevation of privilege vulnerability in Bluetooth could enable a proximate attacker to manage access to documents on the device. This issue is rated as Moderate because it first requires exploitation of a separate vulnerability in the Bluetooth stack. Product: Android. Versions: 5.0.2, 5.1.1,...
chromium-browser: address bar spoofing
Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site...
The vulnerability of the SeaMonkey software allows a malicious actor to compromise the confidentiality and integrity of protected information.
The vulnerability in the implementation of XrayWrapper in Mozilla Firefox and SeaMonkey allows malicious actors to bypass access restrictions by using a specially crafted web page, provided that the user visits it through a debugger. This enables operations such as unwrapping and calling DOM...
IBM Business Process Manager Security Bypass Vulnerability
IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A security vulnerability exists in IBM BPM versions...
CVE-2015-1904
IBM Business Process Manager BPM 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management ECM integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypas...
CVE-2015-1904
IBM Business Process Manager BPM 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management ECM integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypas...
CVE-2015-1904
CVE-2015-1904 affects IBM BPM (BPM) versions 8.0.x through 8.5.6.0 when external ECM integration uses a predefined technical system account, enabling remote authenticated users to bypass document-access restrictions for upload or download. The IBM security bulletin specifies a BPM CMIS integratio...