cfme: Execution of arbitrary methods through filter param

It was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to e.g. destroying VMs...

postgresql: Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pgstatistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access...

postgresql: Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pgstatistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access...

Moodle Unauthorized Modification Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in Moodle version 3.x. The vulnerability stems from th...

postgresql: Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pgstatistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access...

postgresql: Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pgstatistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access...

Medium: postgresql92

Issue Overview: Selectivity estimators bypass SELECT privilege checks It was found that some selectivity estimation functions did not check user privileges before providing information from pgstatistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some...

CVE-2017-6813

A service provided by Zimbra Collaboration Suite ZCS before 8.7.6 fails to require needed privileges before performing a few requested operations...

CVE-2017-6813

A service provided by Zimbra Collaboration Suite ZCS before 8.7.6 fails to require needed privileges before performing a few requested operations...

ALPINE-CVE-2017-7484

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pgstatistic, possibly leaking information. An unprivileged...

Vulnerability in core server (CVE-2017-7484)

selectivity estimators bypass SELECT privilege checks...

DEBIAN-CVE-2016-6608

XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions prior to 4.6.4 are affected...

OIC Exponent CMS Privilege Bypass Vulnerability

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A privilege bypass...

The vulnerability of the Linux operating system, which allows a malicious individual to increase their privileges

Local users can increase their privileges due to the lack of verification of privilege levels in the aaccompatioctl function...

CloudBees Jenkins CI and Jenkins LTS Information Disclosure Vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

OpenJDK: insufficient code privileges checks (JAX-WS, 8054367)

An improper permission check issue was discovered in the JAX-WS component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...

OpenJDK: insufficient code privileges checks (JAX-WS, 8054367)

An improper permission check issue was discovered in the JAX-WS component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...

Missing privilege level checks in x86 emulation of far branches

ISSUE DESCRIPTION The emulation of far branch instructions CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax incompletely performs privilege checks. However these instructions are not usually handled by the emulator. Exceptions to this are - when a memory...

Participants Database Plugin for WordPress 'query' Parameter SQL Injection

The Participants Database Plugin for WordPress installed on the remote host is affected by a SQL injection vulnerability due to a failure to properly sanitize user-supplied input to the 'query' parameter in the pdb-signup script. An unauthenticated, remote attacker can exploit this issue to injec...

openSUSE Security Update : postgresql91 (openSUSE-SU-2013:0627-1)

postgresql was updated to version 9.1.9 bnc812525 : - CVE-2013-1899: Fix insecure parsing of server command-line switches. A connection request containing a database name that begins with '-' could be crafted to damage or destroy files within the server's data directory, even if the request is...