CVE-2020-3374

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...

CVE-2020-3374 Cisco SD-WAN vManage Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...

Cisco SD-WAN vManage Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...

CVE-2020-3335

A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this...

CVE-2020-3335

A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this...

Authorization

A vulnerability in the API subsystem of Cisco Unified Contact Center Express Unified CCX could allow an authenticated, remote attacker to change the availability state of any agent. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit...

Authorization

A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this...

CVE-2020-3335 Cisco Application Services Engine Software Authorization Vulnerability

A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this...

PT-2020-2899

Name of the Vulnerable Software and Affected Versions Cisco Application Services Engine Software affected versions not specified Description A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of...

PT-2020-2682

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Express affected versions not specified Description The issue is related to insufficient authorization enforcement in the API subsystem, allowing an authenticated, remote attacker to change the availability state o...

PT-2020-18070

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.0 through 8.6 IBM Business Automation Workflow versions 18.0 through 19.0 Description The issue is caused by the failure to perform insufficient authorization checks, allowing a remote attacker to bypass...

CVE-2020-4446: Incorrect Authorization

IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126...

PT-2020-18404

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions prior to 8.2.0 Description The issue is related to unauthorized access due to insufficient authorization checks when SyncIQ is licensed but encrypted syncs are not marked as required, potentially leading to loss ...

h1-ctf: [h1-415 2020] Chain of vulnerabilities leading to account takeover and unauthorized access of sensitive internal resources

Note: Please read this report as "An attacker taking over a customer's account" and not as "helping Jobert recovering his document" : Summary: Chaining following issues let's an attacker access sensitive information, 1. Exposure of customer email and regex logic error leading to account takeover ...

CVE-2020-6307

Automated Note Search Tool update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54 does not perform sufficient authorization checks leading to the reading of sensitive information...

Cisco IOS XE Software REST API Authorization Bypass (cisco-sa-20180328-rest)

According to its self-reported version, Cisco IOS XE Software is affected by an authorization bypass vulnerability in the REST API due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An authenticated, remote attacker can exploit this, by...

PT-2019-4462

Name of the Vulnerable Software and Affected Versions SAP ERP Sales versions 6.0 through 6.06, 6.16 through 6.18 S4HANA Sales versions 1.0 through 1.04 Description The issue is related to insufficient authorization checks in the order processing functionality, which can lead to an escalation of...

PT-2019-4463

Name of the Vulnerable Software and Affected Versions SAP Treasury and Risk Management versions prior to S4CORE version 1.05 EA-FINSERV versions prior to 6.07, 6.19, 8.1 Description The issue is related to insufficient authorization checks in the Transaction Management functionality, which can be...

PT-2019-6301

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.22.1 Description The issue is related to insufficient authorization procedure in the container management platform, which can be exploited by a remote attacker to gain full access to the host's file system through...

CVE-2019-1863

Cisco IMC Privilege Escalation (CVE-2019-1863) affects the web-based management interface of Cisco Integrated Management Controller. The root cause is insufficient authorization enforcement, allowing an authenticated user with read-only privileges to change critical configurations with administra...