Improper authorization check in the WorkflowResource class removeStatus method - CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a projec...

CVE-2019-18827: Improper Authorization

On Barco ClickShare Button R9861500D01 devices before firmware version 1.9.0 JTAG access is disabled after ROM code execution. This means that JTAG access is possible when the system is running code from ROM before handing control over to embedded firmware...

CVE-2019-5250

Mate 20 Pro smartphones with versions earlier than 9.1.0.135C00E133R3P1 have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into installing a malicious application before the user turns on...

PT-2019-17532

Name of the Vulnerable Software and Affected Versions Huawei Mate 20 Pro versions prior to 9.1.0.135C00E133R3P1 Description The issue is related to improper authorization, where the software fails to properly restrict certain operations of certain privileges. An attacker could trick a user into...

Authorization

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

CVE-2019-15009

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

CVE-2019-15009

The CVE-2019-15009 issue affects Atlassian Fisheye and Crucible before version 4.8.0. The vulnerability is an improper authorization flaw in the /json/profile/removeStarAjax.do resource, which allowed remote attackers to remove another user’s favourite setting for a project. Affected components i...

PT-2019-13934

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.8.0 Description The issue concerns an improper authorization vulnerability in the /json/profile/removeStarAjax.do resource. This allows remote attackers to remove another user's favourite...

CVE-2019-15009: Undefined Security Weakness

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009

The /json/profile/removeStarAjax.do resource in Atlassian Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009

The /json/profile/removeStarAjax.do resource in Atlassian Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability...

CVE-2019-14870: Improper Authorization

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos...

Razer: Improper Authorization at https://api-my.pay.razer.com/v1/trxDetail?trxId=[Id] allowing unauthorised access to other user's transaction details

The tester determined that the Razer Pay backend server could be exploited to obtain transaction details from another user. Razer Fintech appreciates the detailed report and clear PoC...

The vulnerability of Google Chrome, related to improper authorization, allows a violator to circumvent navigation restrictions.

The vulnerability of Google Chrome is related to improper authorization. Exploiting this vulnerability allows a malicious actor to bypass navigation restrictions using a specially crafted HTML page...

Dell iDRAC Improper Authorization (DSA-2019-137)

The remote host is running iDRAC8 with a firmware version prior to 2.70.70.70 or iDRAC9 with a firmware version prior to 3.36.36.36 and is therefore affected by an improper authorization vulnerability. A remote, authenticated iDRAC user with low privileges can exploit this vulnerability to obtain...

Stripo Inc: Improper Authorization

hi there , i found an vulnerability on https://my.stripo.email/cabinet//users/orogid , generally every user have an organisation and the organisation contain projects , lets suppose : [email protected] is the owner of the project and [email protected] was invited to his project as admin , in normal...

Security Advisory - Improper Authorization Vulnerability in Several Smartphones

There is an improper authorization vulnerability in several smartphones. The software does not properly restrict certain operation of certain privilege, the attacker should trick the user into installing a malicious application before the user turns on student mode function. Successful exploit...

CVE-2019-5308

Mate 20 RS smartphones with versions earlier than 9.1.0.135C786E133R3P1 have an improper authorization vulnerability. The software does not properly restrict certain operation in ADB mode, successful exploit could allow the attacker to switch to third desktop after a series of operation...