Design/Logic Flaw

In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access...

Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

The vulnerability of the fs/fuse/fuse_i.h file in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the fs/fuse/fusei.h file in the Linux operating system’s kernel is related to access to resources through incompatible types. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the GPU Display Driver’s driver lies in the simultaneous execution using shared resources with improper synchronization, allowing a hacker to cause service failure.

The vulnerability of the GPU Display Driver’s driver lies in the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2021-31407

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 Vaadin 12.0.0 through 14.4.9, and 6.0.0 through 6.0.1 Vaadin 19.0.0 allows attacker to access application classes and resources on the server via crafted HTTP request...

GHSA-F6HM-88X3-MFJV A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the...

Citrix Workspace App Assistance for Non-Admins

Clickhere to download Citrix Workspace App. You have been directed to this article because you have questions about or need assistance with Citrix Workspace app and you are NOT an administrator or technical contact for your organization. As a non-admin user of Citrix Workspace app, you must conta...

Intel Ethernet Controllers Access Control Error Vulnerability

Intel Ethernet Controllers is an Ethernet controller from Intel Corporation USA. An Access Control Error vulnerability exists in the Intel 700-series of Ethernet Controllers that arises from a network system or product that does not properly restrict access to resources from unauthorized roles...

Redwood Report2Web File Inclusion Vulnerability

Redwood Report2Web is a web platform from Redwood Corporation that provides users with automated report generation capabilities. A file inclusion vulnerability exists in Redwood Report2Web version 4.3.4.5, which originates from a vulnerability that allows remote attackers to present external...

Unspecified Vulnerability in JetBrains YouTrack

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack that stems from doing improper resourc...

CVE-2021-25766

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made...

Design/Logic Flaw

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made...

CVE-2021-25766

CVE-2021-25766 affects JetBrains YouTrack prior to version 2020.4.4701, due to improper resource access checks in YouTrack (JT-59397). The issue was addressed in JetBrains’ Security Bulletin Q4 2020, with a fix in 2020.4.4701. The Red Hat/NVD entries corroborate the same description. No exploitat...

CVE-2021-25766

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made...

Jetbrains JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack that stems from doing improper resourc...

Red Hat Keycloak Access Control Error Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An access control error vulnerability exists in Red Hat Keycloak before version 13.0.0, which originates from a user being able to access...

XML Entity Injection Vulnerability in Alkacon OpenCms

Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . Alkacon OpenCms suffers from an XML entity injection vulnerability that can be exploited by an attacker to access server resources...

JT2Go and Teamcenter Visualization Access to Resources Incompatibility Vulnerability

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML with existing JT. VFZ, CGM, TIF data.Teamcenter visualization software enables companies to enhance their Product Lifecycle Management PLM environments by enabling business users to access documents, 2D drawings...

CVE-2020-26247 XXE in Nokogiri

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the...

The vulnerability of the Role-Based Access Control (RBAC) access control function in the Cisco Vision Dynamic Signage Director digital content management system allows a intruder to gain access to resources.

The vulnerability of the Role-Based Access Control RBAC access management function in the Cisco Vision Dynamic Signage Director digital content management system is related to errors in access control. Exploiting this vulnerability could allow an attacker to gain access to resources remotely...