PT-2021-6696 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.10 and later Description: The issue is related to an information disclosure problem, where a lack of access control checking allows a remote attacker to gain access to confidential data. This enables a user to read proje...

CVE-2021-20440

IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider...

VulnCheck KEV: CVE-2020-26919

Netgear JGS516PE devices contain a missing function level access control vulnerability...

CVE-2020-35783

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, GS116Ev2 before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and JGS524PE before 2.6.0.48. The NSDP protocol version allows unauthenticated remote attackers to obtain all the switc...

CVE-2020-27183

A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact...

CVE-2020-27183: Undefined Security Weakness

A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact...

PT-2020-16654

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue is related to a RemoteFunctions endpoint with missing access control, allowing attackers to disclose sensitive user information, send arbitrary e-mails, escalate the...

CVE-2020-8235

Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments...

PT-2020-20046

Name of the Vulnerable Software and Affected Versions Nextcloud Deck version 1.0.4 Description The issue is related to missing access control, which results in an insecure direct object reference. This allows an attacker to view all attachments. Recommendations For Nextcloud Deck version 1.0.4,...

CVE-2020-19888

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

RHEL 8 : CloudForms 5.0.7 update (Critical) (RHSA-2020:3358)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3358 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...

CVE-2020-15518

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests...

DRUPAL-CONTRIB-2020-020

Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never...

CVE-2020-4348

IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414...

The vulnerability of the Internal Operations component of the Oracle Service Intelligence software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Internal Operations component of the Oracle Service Intelligence software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network...

PT-2020-19975

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 18.0.1 Nextcloud Server versions prior to 17.0.4 Nextcloud Server versions prior to 16.0.9 Description A missing access control check in the software causes hide-download shares to be downloadable when...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software allows a perpetrator to gain access to data modification capabilities.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data...

WordPress Unauthorized Operation Vulnerability (CNVD-2020-03944)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions prior to 5.3.1, which stems from a lack of access contro...

Magento Security Feature Issue Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A security feature issue vulnerability exists in Magento version 2.2 and 2.3. The vulnerability stems from a lac...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...