Search from the Slack app ignores permissions in Confluence

h3. Issue Summary Search from the Slack app ignores permissions in Confluence. There are different scenarios where we see an issue with searching Confluence from Slack: If a user doesn't have permissions to access the space, they can still search for content Search returns information from Spaces...

CVE-2019-20807

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces e.g., Python, Ruby, or Lua...

DEBIAN-CVE-2019-20807

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces e.g., Python, Ruby, or Lua...

UBUNTU-CVE-2019-20807

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces e.g., Python, Ruby, or Lua...

CVE-2019-20807

CVE-2019-20807 affects Vim prior to 8.1.0881, where a user can bypass the rvim restricted mode and run arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, Lua). Affected product: Vim (Unix/Linux environments). Root cause: restricted-mode bypass enabling execution of external comma...

CVE-2019-20807

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces e.g., Python, Ruby, or Lua...

The vulnerability of the streaming service (default port 5410/tcp) of the SiNVR 3 video server, which allows a perpetrator to gain access to protected information.

The vulnerability of the streaming service port 5410/tcp by default of the SiNVR 3 video server is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain access to protected information...

Minimalistic-offensive-security-tools - A Repository Of Tools For Pentesting Of Restricted And Isolated Environments

Minimalistic SMB loginbruteforcer smblogin.ps1 A simple SMB login attack and password spraying tool. It takes a list of targets and credentials username and password as parameters and it tries to authenticate against each target using the provided credentials. Despite its minimalistic design, the...

Starbucks: Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted data

zlz and rhynorater discovered that by obtaining a valid authentication cookie and then combining that with a path traversal, this allowed access to restricted data. noapearson assisted by providing additional information post discovery. @zlz / @rhynorater / @noapearson — thank you for reporting...

The vulnerability of the microprogramming software used in access control systems for the NetScaler Gateway virtual environment and the Citrix NetScaler Application Delivery Controller lies in the improper name restrictions on the path to the restricted directory. This allows attackers to gain access to published applications and carry out attacks from the Citrix server to other resources within the attacked company’s internal network.

The vulnerability of the microprogramming software used in access control systems for the NetScaler Gateway virtual environment, as well as the microprogramming software used in the Citrix NetScaler Application Delivery Controller, exists due to an incorrect limitation on the path name to the...

Microsoft Windows and Windows Server Privilege Mobilization Vulnerability (CNVD-2020-33422)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A privilege extraction vulnerability exists in Microsoft Windows and Windows Server, which...

CVE-2020-2016

A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting anothe...

PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation

A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting anothe...

SAP Business Objects Business Intelligence Platform Information Disclosure Vulnerability (CNVD-2020-29751)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An information disclosure vulnerability exists in SAP Business Object...

SAP Adaptive Server Enterprise Injection Vulnerability

SAP Adaptive Server Enterprise ASE is a relational database server from SAP, Germany. An injection vulnerability exists in SAP Adaptive Server Enterprise, which originates when the program does not perform the required authentication checks on an authenticated user. An attacker could exploit the...

CVE-2020-6251

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted...

CVE-2020-6259

Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check...

PT-2020-2521 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions prior to 10.0.18363 Description: An elevation of privilege issue exists due to the Windows kernel-mode driver's failure to properly handle objects in memory. This allows an attacker to potentially elevate their privileges. Th...

GNUTeca Path Traversal Vulnerability

Solis Gnuteca is a library management system from Solis Brazil. The system includes features such as e-mail alerts, automated inventory, location tracking and user registration. A path traversal vulnerability exists in Solis GNUTeca version 3.8. The vulnerability stems from the failure of a...

Tryton v5.4 - (Name) Persistent Cross Site Vulnerability

Document Title: =============== Tryton v5.4 - Name Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2233 ID: https://discuss.tryton.org/t/security-release-for-issue9351/2772 Release Date: ============= 2020-05-11...