User Rights Access Manager < 1.0.4 - Improper Access Controls

The plugin did not properly restrict access to some paths, still allowing a restricted user to access them, and edit the Blog Options, create/edit posts and so on for example To reproduce it, install the plugin, create a new admin user and take all his privileges using the mentioned plugin block...

User Rights Access Manager < 1.0.4 - Improper Access Controls

The plugin did not properly restrict access to some paths, still allowing a restricted user to access them, and edit the Blog Options, create/edit posts and so on for example PoC To reproduce it, install the plugin, create a new admin user and take all his privileges using the mentioned plugin...

CVE-2020-4762

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.52, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896...

CVE-2020-4762

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.52, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896...

CVE-2020-4762: Undefined Security Weakness

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.52, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896...

CVE-2020-12331: Undefined Security Weakness

Improper access controls in Intel UniteR Cloud Service client before version 4.2.12212 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-7295 Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface...

CVE-2020-7295: Improper Authentication

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface...

CVE-2020-7293: Improper Authentication

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password via improper access controls in the user interface...

CVE-2020-3360: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

ManageEngine Desktop Central < 10 Build 10.0.515 Information Disclosure

The ManageEngine Desktop Central application running on the remote host is prior to version 10 build 10.0.515. It is, therefore, affected by an information disclosure vulnerability in the PDFGenerationServlet component due to improper access controls. An unauthenticated, remote attacker can explo...

CVE-2020-4203

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. IBM X-Force ID: 174956...

CVE-2020-4203: Undefined Security Weakness

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. IBM X-Force ID: 174956...

GDPR Cookie Consent < 1.8.3 - Improper Access Controls

Improper Access Controls issue in the clipolicygenerator AJAX call which could allow an authenticated user with low privileges such as a subscriber to: - Change the status of any post/page from published to draft, removing them from the frontend of the blog. - Put a payload in the content of one...

Security Bulletin: Multiple Information disclosure vulnerabilities affect IBM Sterling B2B Integrator (CVE-2017-1302, CVE-2017-1193)

Summary IBM Sterling B2B Integrator Standard Edition could allow a local user to view sensitive information due to improper access controls Vulnerability Details CVEID: CVE-2017-1302 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a local user to view sensitive information d...

Stripo Inc: Able to download any hosted content on AWS S3 bucket(stripo)

An AWS s3 bucket was found, with improper access controls, where all its contents could be downloaded. Steps to reproduce: 1. List contents of the bucket with: aws s3 ls s3://stripo 2. Download the hosted data with : aws s3 sync s3://stripo . Impact Any hosted data can be downloaded to an attacke...

CVE-2019-1622 Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)

According to its self-reported version, this Cisco Small Business RV Series router is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker wi...

CVE-2019-1653 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

Shopify: H1514 Bypass Wholesale account signup restrictions

Summary: By default, account registration is disabled on Shopify Wholesale, requiring customers to be manually invited: Wholesale account signup is disabled. Customers need to be manually invited from the Customers page. This can be bypassed due to improper access controls in the invitation...