PT-2020-18986

Name of the Vulnerable Software and Affected Versions SAP Host Agent version 7.21 Description The issue allows an unprivileged user to read or write to the shared memory by sending a request to the main SAPOSCOL process. This can lead to the user receiving responses that contain data read with ro...

PT-2020-18991

Name of the Vulnerable Software and Affected Versions SAP APPL versions 600 through 606, 616 SAP FIN versions 617 through 618, 700, 720, 730 SAP S/4 HANA versions 100 through 104 Description The issue is related to Missing Authorization Check in VAT Pro-Rata reports. This occurs because the repor...

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwpmmbsetrequest in init.php. Any attacker who knows the username of an administrator can log in...

Information leak through broken access control in Jira Server and Data Center - CVE-2019-20407

The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check...

Atlassian JIRA < 7.13.12 / 8.x < 8.4.3 / 8.5.x < 8.5.2 Authorization Bypass (JRASERVER-70405)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.12, 8.x prior to 8.4.3, or 8.5.x prior to 8.5.2 / 8.6.0. It is, therefore, affected by an authorization bypass vulnerability. The vulnerability exists in the...

PT-2019-13936

Name of the Vulnerable Software and Affected Versions Jira versions prior to 7.13.12 Jira versions 8.0.0 through 8.4.3 Jira versions 8.5.0 through 8.5.2 Description The issue is related to a missing authorization check in the removeStatus method of the WorkflowResource class. This allows...

PT-2019-13930

Name of the Vulnerable Software and Affected Versions Atlassian Troubleshooting and Support Tools plugin versions prior to 1.17.2 Bitbucket Server / Data Center versions prior to 6.6.0 Confluence Server / Data Center versions prior to 7.0.1 Jira Server / Data Center versions prior to 8.3.2 Crowd ...

CVE-2019-0367

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

CVE-2019-0367

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

PT-2019-4330

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration B2B Toolkit versions prior to 1.0 and 2.0 Description The issue is related to missing authorization checks for authenticated users, allowing the import of B2B table content. This can lead to a Missing...

Improper Authorization in Crowd through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Crowd & Crowd Data Center before version 3.6.0, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization...

Authorization

SAP Kernel ABAP Debugger, versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to...

CVE-2019-0349: Missing Authorization

SAP Kernel ABAP Debugger, versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to...

CVE-2018-20826

The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check...

CVE-2019-3399

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...

PT-2019-16556

Name of the Vulnerable Software and Affected Versions Jira versions prior to 7.13.2 Jira versions 8.0.0 through 8.0.1 Description The issue allows remote attackers to see information for archived projects due to a missing authorization check in the BrowseProjects.jspa resource. Recommendations Fo...

CVE-2019-3399: Incorrect Authorization

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...

SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2018:2564-1)

This update for postgresql10 fixes the following issues : PostgreSQL 10 was updated to 10.5 : https://www.postgresql.org/about/news/1851/ https://www.postgresql.org/docs/current/static/release-10-5.html A dump/restore is not required for those running 10.X. However, if you use the adminpack...

PT-2018-10819

Name of the Vulnerable Software and Affected Versions Apache Impala versions prior to 3.0.1 Description The issue is related to a missing authorization check, allowing a Kerberos-authenticated but unauthorized user to inject random data into a running query. This can lead to incorrect results for...

WordPress DTracker plugin content injection vulnerability (CNVD-2017-31142)

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.DTracker is one of the plugins used to track site downloads. A content injection vulnerability exists in...