CVE-2015-5233

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply viewhosts permissions, which allows 1 remote authenticated users with the viewreports permission to read reports from arbitrary hosts or 2 remote authenticated users with the destroyreports permission to delete reports from arbitra...

Sql injection

SQL injection vulnerability in the hostnewgraphs function in graphsnew.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cgg parameter in a save action...

Code injection

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply viewhosts permissions, which allows 1 remote authenticated users with the viewreports permission to read reports from arbitrary hosts or 2 remote authenticated users with the destroyreports permission to delete reports from arbitra...

CVE-2015-8604

SQL injection vulnerability in the hostnewgraphs function in graphsnew.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cgg parameter in a save action...

Design/Logic Flaw

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

CVE-2016-0735

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...

CVE-2015-0266

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

CVE-2016-3675

SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases...

Sql injection

SQL injection vulnerability in graphview.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the hostgroupdata parameter...

CVE-2016-1235

The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options...

UBUNTU-CVE-2016-1235

The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options...

CVE-2016-3659

SQL injection vulnerability in graphview.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the hostgroupdata parameter...

CVE-2016-3675

CVE-2016-3675 is a SQL injection vulnerability in Huawei Policy Center affecting versions before V100R003C10SPC020 (and variants cited V100R003C00, V100R003C10SPC020). The issue allows remote authenticated users to execute arbitrary SQL commands through unspecified vectors related to system datab...

CVE-2016-3675

SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases...

Directory traversal

Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. dot dot in a ZIP archive entry...

Authorization

The XML Data Archiving Service XML DAS in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to 1 webcontent/cas/casenter.jsp, 2...

CVE-2016-0888

EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors...

CVE-2016-0888

EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors...

CVE-2016-0888

Affected product: EMC Documentum D2 (versions before 4.6). Vulnerability: Insufficient ACLs for D2 configuration objects allow a remote authenticated user to modify (and in at least one source, delete) D2 objects via unspecified vectors. The root cause is failure to enforce secure access control ...

Cisco Prime Infrastructure elevation of privilege vulnerability (CNVD-2016-02072)

Cisco Prime Infrastructure is the United States Cisco Cisco company's set of wireless management through the Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technology solutions. An elevation of privilege vulnerability exists in Cisco Prime Infrastructure 1.2.0...