CVE-2018-13382: Incorrect Authorization

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via...

CVE-2017-18376

An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala...

CVE-2017-18376

An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala...

CVE-2017-18376

An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala...

CVE-2017-18376

The Hive vulnerability CVE-2017-18376 is an improper authorization check in the User API (app/controllers/UserCtrl.scala) that lets users with read-only or read/write access escalate to administrator privileges. Affected versions are TheHive before 2.13.4 and 3.x before 3.3.1. Impact details indi...

PT-2019-2799

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.4.1 through 5.4.10 FortiOS versions 5.6.0 through 5.6.8 FortiOS versions 6.0.0 through 6.0.4 FortiProxy versions 1.0.0 through 1.0.7 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.2.0 through 1.2.8 FortiProxy...

Slims CMS Akasia 8.3.1 SQL Injection

Exploit Title : Slims CMS Akasia 8.3.1 Improper Authorization Vulnerability Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 20/05/2019 Vendor Homepage : slimsetd.id - slims.web.id Software Download Link : slims.web.id/goslims/?wpdmpro=slims-8-3-1-akasia Software...

CVE-2019-1851: Improper Authorization

A vulnerability in the External RESTful Services ERS API of the Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority CA Services on ISE. This vulnerability is due to an incorrect...

CVE-2019-1859: Improper Authorization

A vulnerability in the Secure Shell SSH authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. ...

CVE-2019-3842: Improper Authorization

In systemd before v242-rc4, it was discovered that pamsystemd does not properly sanitize the environment before using the XDGSEAT variable. It is possible for an attacker, in some particular configurations, to set a XDGSEAT environment variable which allows for commands to be checked against polk...

CVE-2015-5463: Improper Authorization

AxiomSL's Axiom java applet module used for editing uploaded Excel files and associated Java RMI services 9.5.3 and earlier allows remote attackers to 1 access data of other basic users through arbitrary SQL commands, 2 perform a horizontal and vertical privilege escalation, 3 cause a Denial of...

GHSA-535V-4X9Q-446C Improper Authorization in org.apache.hbase:hbase

In all previously released Apache HBase 2.x versions 2.0.0-2.0.4, 2.1.0-2.1.3, authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. Th...

Improper Authorization

Overview Versions of googleapis prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials. Recommendation Upgrade to version 39.1.0. References - GitHub...

CVE-2019-3849: Improper Authorization

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...

CVE-2015-3954: Improper Authorization

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira...

(0Day) (Pwn2Own) Xiaomi Mi6 Browser downloadAndInstallApk Improper Authorization Remote Code Execution Vulnerability

This vulnerability allows network adjacent attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser. User interaction is required to exploit this vulnerability in that the target must connect to a malicious access point. The specific flaw exists within the handling of...

PT-2019-16715

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller versions prior to 1.78.0 Description The issue concerns an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed...

CVE-2019-3785: Improper Authorization

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service...

CVE-2019-3785: Cloud Controller provides signed URL with write authorization to read only user | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions CAPI All versions prior to 1.78.0 Description Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read...

CVE-2019-1604: Improper Authorization

A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check of user accounts and their associated Group ID GID. An...