PT-2018-2663

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 10.5 PostgreSQL versions prior to 9.6.10 PostgreSQL versions prior to 9.5.14 PostgreSQL versions prior to 9.4.19 PostgreSQL versions prior to 9.3.24 Description The issue is related to errors in authorization withi...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778: Improper Authorization

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

PT-2018-16989

Name of the Vulnerable Software and Affected Versions NetApp 7-Mode Transition Tool versions prior to 2.0 Description The issue allows users with valid credentials to access functions and information that may have been intended for administrators or privileged users. This occurs because versions...

CVE-2018-0391: Improper Authorization

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this...

CVE-2018-12467: Improper Authorization

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689...

CVE-2018-12466: Improper Authorization

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links...

CVE-2017-2632: Improper Authorization

A logic error in validrole in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges...

CVE-2017-2589: Improper Authorization

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2018-1999004

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches...

CVE-2018-1999004

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches...

CVE-2018-1999003

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds...

CVE-2018-1999004

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches...

CVE-2018-1999004

The connected sources confirm CVE-2018-1999004 is an improper authorization flaw in Jenkins prior to version 2.133 (and prior to 2.132/2.121.1 as cited by various records) affecting SlaveComputer.java, where users with Overall/Read permission can initiate agent launches and abort in-progress laun...

CVE-2018-1999003: Incorrect Authorization

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds...

CVE-2018-1999004: Incorrect Authorization

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches...

PT-2018-15188

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.132 and earlier Jenkins versions 2.121.1 and earlier Description A vulnerability exists due to improper authorization in Queue.java, allowing attackers with Overall/Read permission to cancel queued builds. Recommendations Fo...