Microsoft Internal Solorigate Investigation - Final Update

We believe the Solorigate incident is an opportunity to work with the community, to share information, strengthen defenses and respond to attacks. We have now completed our internal investigation into the activity of the actor and want to share our findings, which confirm that we found no evidenc...

kernel: umask not applied on filesystem without ACL support

A vulnerability was found in NFSv4.2 in the Linux kernel, where a server fails to correctly apply umask when creating a new object on filesystem without ACL support for example, ext4 with the "noacl" mount option. This flaw allows a local attacker with a user privilege to cause a kernel informati...

kernel: umask not applied on filesystem without ACL support

A vulnerability was found in NFSv4.2 in the Linux kernel, where a server fails to correctly apply umask when creating a new object on filesystem without ACL support for example, ext4 with the "noacl" mount option. This flaw allows a local attacker with a user privilege to cause a kernel informati...

Nextcloud Deck Information Disclosure Vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Deck 1.0.4, which stems from a lack of access control and can be exploited by an attacker to view all attachments...

The vulnerability of the Intel Graphics Driver lies in its lack of access control mechanisms, allowing attackers to gain access to protected information.

The vulnerability of the Intel Graphics Driver lies in its lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to gain access to protected information...

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, Cisco Small Business RV130, Cisco Small Business RV130W, and Cisco Small Business RV215W allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the web-based management interface for Cisco Small Business RV110W, Cisco Small Business RV130, Cisco Small Business RV130W, and Cisco Small Business RV215W lies in the lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to execute...

CVE-2020-12493

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the Absence Recording component in the Oracle Human Resources HR management software allows a violator to gain access to modify, add, or delete data.

The vulnerability of the Absence Recording component in the Oracle Human Resources HR management software is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data using the HTTP protocol...

The vulnerability of the Database Gateway for ODBC component of the Oracle Database Server allows a hacker to gain full control over the application.

The vulnerability of the Oracle Database Server ODBC driver’s database server lies in its lack of access control mechanisms. Exploiting this vulnerability allows an attacker to gain full control over the application through the OracleNet network protocol...

DEBIAN-CVE-2013-3564

The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other commands without authenticating...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to trigger a service failure.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2019-16931

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...

PT-2019-6425 · Ruijie · Ruijie Eg-2000Se

Name of the Vulnerable Software and Affected Versions: Ruijie EG-2000SE versions 11.9 B11P1 Description: The issue is related to the newcli.php API interface in the Ruijie EG-2000SE gateway, which lacks access control. This allows an attacker with web interface access to use TELNET commands and...

The vulnerability of the Infrastructure component of Oracle Retail Point-of-Service software allows a hacker to gain access to protected information, alter file access rights, or cause partial service disruption.

The vulnerability of the Oracle Retail Point-of-Service software’s infrastructure component is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain access to protected information, modify file access rights, or cause partial service interruptions...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2019-6637

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

Lob: No Access Control

There is "No Access Control" vulnerability identified in "lob-assets.com" on Invoice section. Steps To Reproduce: Go to...

UBUNTU-CVE-2019-10868

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values...

CVE-2017-2752

A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered in Tommy Hilfiger TH24/7 Android app versions 2.0.0.11, 2.0.1.14, 2.1.0.16, and 2.2.0.19. HP has no access to customer data as a result of this issue...