HackerOne: Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants

Hello Hackerone, I find bug with it team Members associated with a Group have only permission Post internal comments can post comment to all the participants Bypass it just with Add comma ',' isinternal=,...

Cisco TelePresence Video Communication Server Expressway Unauthorized Access Vulnerability

Cisco TelePresence Video Communication Server is a telepresence video communication server from Cisco. Cisco TelePresence Video Communication Server VCS Expressway X8.6 has a security vulnerability in its implementation, which can be exploited by an authenticated remote user to bypass the target...

CVE-2015-6413

Cisco TelePresence VCS Expressway X8.6 contains a web‑framework access control flaw that allows remote authenticated users to bypass read‑only restrictions and upload Tandberg Linux Package (TLP) files by visiting an administrative page (CVE-2015-6413). Root cause: missing authorization checks on...

pacemaker: acl read-only access allow role assignment

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well...

Moderate: Red Hat Security Advisory: binutils security, bug fix, and enhancement update

Updated binutils packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

FreeBSD : xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen (301b04d7-881c-11e5-ab94-002590263bf5)

"The Xen Project reports : Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen the upstream-based qemu %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

CVE-2013-1957

The clonemnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNTREADONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace...

Xen Elevation of Privilege Vulnerability

Xen is a virtualization technology used in the Linux kernel that allows multiple operating systems to run simultaneously. An elevation of privilege vulnerability exists in Xen 4.1.x through 4.6.x that allows a local user to write a read-only disk image...

CVE-2015-7311

libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image...

UBUNTU-CVE-2015-7311

libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image...

CVE-2015-6464

The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin...

CVE-2015-6464

CVE-2015-6464 affects Moxa EDS-405A/EDS-408A switches. The administrative web interface contains an improper privilege management flaw that lets remote authenticated users bypass the read-only protection via a Firefox web developer plugin. Impact: elevation of privileges (read/write where only re...

CVE-2015-6464

The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin...

Input validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

Cisco TelePresence Video Communication Server Expressway Arbitrary Command Execution Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

pacemaker: acl read-only access allow role assignment

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well...

PT-2015-5478 · Clusterlabs +3 · Pacemaker +3

Name of the Vulnerable Software and Affected Versions: Pacemaker versions prior to 1.1.13 Description: The issue allows remote read-only users to gain privileges via an acl command due to improper evaluation of added nodes. Recommendations: For versions prior to 1.1.13, update to version 1.1.13 o...

[SECURITY] Fedora 22 Update: squashfs-tools-4.3-11.fc22

Squashfs is a highly compressed read-only filesystem for Linux. This packa ge contains the utilities for manipulating squashfs filesystems...

CVE-2015-1223

Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change...