454 matches found
CVE-2020-8919
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...
CVE-2020-27183
A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact...
CVE-2020-27183: Undefined Security Weakness
A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact...
PT-2020-16654
Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue is related to a RemoteFunctions endpoint with missing access control, allowing attackers to disclose sensitive user information, send arbitrary e-mails, escalate the...
CVE-2020-8235
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments...
PT-2020-20046
Name of the Vulnerable Software and Affected Versions Nextcloud Deck version 1.0.4 Description The issue is related to missing access control, which results in an insecure direct object reference. This allows an attacker to view all attachments. Recommendations For Nextcloud Deck version 1.0.4,...
CVE-2020-15170
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internetwhich is not recommended, there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Maliciou...
CVE-2020-15170: Improper Input Validation
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internetwhich is not recommended, there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Maliciou...
CVE-2020-19888
DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...
RHEL 8 : CloudForms 5.0.7 update (Critical) (RHSA-2020:3358)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3358 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...
CVE-2020-15518
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests...
DRUPAL-CONTRIB-2020-020
Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never...
CVE-2020-4348
IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414...
The vulnerability of the Internal Operations component of the Oracle Service Intelligence software allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Internal Operations component of the Oracle Service Intelligence software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network...
PT-2020-19975
Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 18.0.1 Nextcloud Server versions prior to 17.0.4 Nextcloud Server versions prior to 16.0.9 Description A missing access control check in the software causes hide-download shares to be downloadable when...
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software allows a perpetrator to gain access to data modification capabilities.
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data...
WordPress Unauthorized Operation Vulnerability (CNVD-2020-03944)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions prior to 5.3.1, which stems from a lack of access contro...
CVE-2019-18981
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification...
Magento Security Feature Issue Vulnerability
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A security feature issue vulnerability exists in Magento version 2.2 and 2.3. The vulnerability stems from a lac...