Authorization

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this...

PT-2018-8843

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description The issue is related to insufficient authorization and parameter validation checks in the REST API. An authenticated, remote attacker could exploit...

CVE-2017-17708

Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3...

Authorization

Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3...

CVE-2017-17708: Incorrect Authorization

Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3...

PT-2018-6552

Name of the Vulnerable Software and Affected Versions: Pleasant Password Server versions prior to 7.8.3 Description: The issue is due to insufficient authorization checks, allowing any authenticated user to modify profile data of other users. Recommendations: For versions prior to 7.8.3, update t...

CVE-2018-0393

A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this...

PT-2018-8808

Name of the Vulnerable Software and Affected Versions Cisco Policy Suite affected versions not specified Description A vulnerability in the Policy Builder interface could allow an authenticated, remote attacker to make policy changes due to insufficient authorization controls. The attacker could...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Insufficient Authorization Checks vulnerability (CVE-2018-1368 )

Summary IBM Security Guardium Database Activity Monitor has addressed the following vulnerability Vulnerability Details CVEID: CVE-2018-1368 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a local user with low privileges to view report pages and perform some actions that...

Security Bulletin: Insufficient authorization check for project actions in WebSphere Lombardi Edition (CVE-2014-4844)

Summary By using WebSphere Lomabrdi Edition WLE you can import and export process applications and toolkits. Although this functionality is available only to authorized users, the actual server side code accepts requests from lower privileged users. Vulnerability Details CVE ID: CVE-2014-4844 CVS...

Security Bulletin: Insufficient authorization check in IBM Business Process Manager (BPM) Search REST API (CVE-2014-6139)

Summary Using the Search REST API, non-administrative users can search for task and process instances that they are not allowed to see by specifying a parameter that should be available only to administrative users. Vulnerability Details CVE ID: CVE-2014-6139 CVSS Base Score: 3.5 CVSS Temporal...

Security Bulletin: Insufficient authorization check for project actions in IBM Business Process Manager (CVE-2014-4844)

Summary By using IBM Business Process Manager BPM you can import and export process applications and toolkits. Although this functionality is available only to authorized users, the actual server side code accepts requests from lower privileged users. Vulnerability Details CVE ID: CVE-2014-4844...

Authorization

A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could...

CVE-2018-0336

A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could...

PT-2018-15546

Name of the Vulnerable Software and Affected Versions SAP Enterprise Financial Services versions 1.11 through 1.12 SAP Enterprise Financial Services versions 1.01 through 1.02 SAP Enterprise Financial Services versions 6.04 through 6.06 SAP Enterprise Financial Services versions 6.16 through 6.18...

Cisco IOS XE Software REST API Authorization Bypass Vulnerability

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

PT-2018-15513

Name of the Vulnerable Software and Affected Versions SAP ERP Financials Information System versions 6.00 through 6.06, 6.16 SAP ERP Financials Information System version 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE versions 1.00 through 1.02 Description The issue results from insufficient authorization...

Authorization

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device...

CVE-2017-2306

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device...

CVE-2017-2305: Incorrect Authorization

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation...