CVE-2015-4319: Undefined Security Weakness

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

PT-2015-6509

Name of the Vulnerable Software and Affected Versions Cisco Unified Web and E-Mail Interaction Manager versions 9.02 and 11.01 Description The issue is related to improper authorization, allowing remote authenticated users to read or write to stored data. Recommendations For version 9.02, update ...

PT-2015-6510

Name of the Vulnerable Software and Affected Versions Cisco Unified Web and E-Mail Interaction Manager version 9.02 Description The issue is related to improper authorization, allowing remote authenticated users to remove default messaging-queue system folders. Recommendations For Cisco Unified W...

CVE-2015-4299: Improper Access Control

Cisco Unified Web and E-Mail Interaction Manager 9.02 improperly performs authorization, which allows remote authenticated users to remove default messaging-queue system folders via unspecified vectors, aka Bug ID CSCuo89046...

EMC Documentum Content Server Multiple Vulnerabilities (ESA-2015-131)

The version of EMC Documentum Content Server running on the remote host is affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to improper authorization checks performed on subgroups within the dmsuperusers group. An authenticated, remote attacker can exploit...

PT-2015-6459

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meeting Center affected versions not specified Description The issue allows remote attackers to obtain sensitive information by exploiting improper authorization for reading a host calendar. This can be done by obtaining a list of...

Hospira LifeCare PCA Infusion System Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in Hospira’s LifeCare PCA Infusion System, which NCCIC/ICS-CERT has been coordinating with Hospira since May 2014. This advisory is...

Microsoft Windows NtApphelpCacheControl Improper Authorization Check Exploit

Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' class Metasploit3 'Microsoft Windows...

PT-2014-6029

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP2 P17 EMC Documentum Content Server versions 7.0 through P15 EMC Documentum Content Server versions prior to 7.1 P08 Description The issue allows remote authenticated sysadmins to gain...

PT-2014-6028

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions 7.0 through P15 EMC Documentum Content Server version 7.1 before P08 EMC Documentum Content Server before 6.7 SP2 P17 Description The issue allows remote authenticated users to obtain super-user privilege...

EMC Documentum Content Server Information Disclosure (ESA-2014-026)

The remote host is running a version of EMC Documentum Content Server that is affected by an information disclosure vulnerability due to improper authorization checks. A remote, authenticated user can exploit this vulnerability to read metadata from folders outside of restricted folders configure...

EMC Documentum Content Server Multiple Vulnerabilities (ESA-2014-064)

The remote host is running a version of EMC Documentum Content Server that is affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper authorization checks. A remote, authenticated attacker can exploit this vulnerability to execute arbitrary code via a...

PT-2014-4752

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P28 EMC Documentum Content Server versions 6.7 SP2 prior to P15 EMC Documentum Content Server versions 7.0 prior to P15 EMC Documentum Content Server versions 7.1 prior to P06 Description...

PT-2014-4751

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P28 EMC Documentum Content Server versions 6.7 SP2 prior to P15 EMC Documentum Content Server versions 7.0 prior to P15 EMC Documentum Content Server versions 7.1 prior to P06 Description...

Improper authorization checks in files_external - ownCloud

Due to not verifying whether an user has been granted access to add external storages an authenticated user could even mount external storage e.g. SMB/FTP/etc. without permission. Affected Software ownCloud Server 6.0.3 CVE-2014-3835 ownCloud Server 5.0.16 CVE-2014-3835 Action Taken We reviewed t...

Server: Improper authorization checks in documents

Due to not verifying whether an user has permission to rename files of other users an authenticated user could rename files of other users without permission. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Server: Improper authorization checks in contacts

Due to not verifying whether an user has been granted access to an address book, authenticated users are able to access arbitrary contacts of other users. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Server: Improper authorization checks in files_external

Due to not verifying whether an user has been granted access to add external storages an authenticated user could even mount external storage e.g. SMB/FTP/etc. without permission. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

CVE-2014-2349: Improper Authorization

Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program...

CommonSpot < 7.0.2 / 8.0.3 / 9.0.0 Multiple Vulnerabilities

According to its version number, the CommonSpot install hosted on the remote web server is affected by multiple vulnerabilities : - An access restriction bypass via a direct request. CVE-2014-2859 - Multiple cross-site scripting XSS vulnerabilities. CVE-2014-2860, CVE-2014-2861 - Improper...