Edit permission check not enforced on WebDAV COPY action - ownCloud

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. Affected Software ownCloud Server 9.0.4 CVE-2016-????...

Server: Edit permission check not enforced on WebDAV COPY action

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. For more information please consult the official advisory. This...

Server: Read-only share recipient can restore old versions of file

The restore capability of ownCloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Edit permission check not enforced on WebDAV COPY action (NC-SA-2016-004)

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files...

Read-only share recipient can restore old versions of file (NC-SA-2016-005)

The restore capability of Nextcloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions...

The vulnerability of Xen hypervisors allows a hacker to write data to a disk that is only intended for reading.

The vulnerability of the libxl library in Xen hypervisors arises from the lack of restrictions on writing data when using the qemu-xen device. Exploiting this vulnerability allows a malicious actor to write data to a disk that is intended only for reading...

Nextcloud: Read-only share recipient can restore old versions of file

The restore capability of Nextcloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions. A detailed advisory can be found at https://nextcloud.com/security/advisory/?id=nc-sa-2016-005. ------ Thanks a lot,...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)

qemu was updated to fix 37 security issues. These security issues were fixed : - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avo...

Up.time agent for Linux does not authenticate a user before allowing read access to the file system

Overview The up.time agent for Linux versions 7.5 and 7.6 may allow an unauthenticated remote attacker to read arbitrary files from a system. Description CWE-306: Missing Authentication for Critical Function - CVE-2015-8268According to the researcher, "The linux based uptime.agent version 7.5...

Ubiquiti Inc.: Read-Only user can execute arbitraty shell commands on AirOS

This vulnerability is very similar to 128750, but it avoid the solution applied to the last beta XM firmware. In this report is used the last beta XM firmware: XM.v6.0-beta9 Vulnerability The vulnerability resides in the function fetchCookies file remote.inc:117. Just like last time is a non...

The exception in the exception--by means of a system of exception handling exception achieve incredible exploit-vulnerability warning-the black bar safety net

Memory read, write, execute attribute is system security the most important one of the mechanisms. Usually, if you want to overwrite the data in memory, you must first ensure that the block of memory having a write attribute, if you want to execute a piece of code in memory, you must first ensure...

HackerOne: Email Address Leak

Hello, I have found out that when a team invites a team member via username, the email address of the invited user is being disclosed after he accepted it. This can be abused since we all know that the email address is not publicly visible through hackerone profile. One team can abuse its functio...

March 8, 2016, update for Office 2016 (KB3114857)

None None...

HackerOne: User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions

Poc : 1.Login into Programtestbug as Alice account 2.Create a new group with "Read-only" Permission . Add a Bob to that group 3.Bob report a bug to Programtestbug After Post "Some Internal comments" 4.Now Alice Revoke the Bob team access permissions so Bob is no longer part of the team 5.Bob...

HackerOne: User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports

Poc : 1.Login into Programtestbug as owner account 2.Create a new group with "Reward" Permission . Add a user to that group 3.Create a new group with "Read-only" Permission . Add a user to that group 3.Login into user account Report a bug to Program testbug 4."Reward" Permission User awarded a sw...

HackerOne: User with Read-Only permissions can manually public disclosure the report

Hello, I would like to report an incomplete fix of 109483 this report .manually disclose functionality is not consider for fix that cause read-only team members to post a public comment. In hackerone public disclose have a three types 1.Team/User Request a public disclose a bug 2.Team/user Agree ...

CVE-2015-7469

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role...

CVE-2015-7469

CVE-2015-7469 affects IBM Jazz Reporting Service (JRS) Report Builder. The vulnerability arises from improper access control: users with JazzGuest roles can manipulate data that should be read-only. Affected versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0. IBM’s bulletin recomme...

CVE-2015-7469

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role...

HackerOne: User with Read-Only permissions can request/approve public disclosure

Hi, I found out that a user who belongs to a group with Read-Only permission can still request and approuve public disclosure when the report is closed by privileged admin although that these permissions are only allowed if the user group has Report scope. Consequently, the team member with limit...