The vulnerability in the web interface of the Cisco Identity Services Engine allows a perpetrator to modify the configuration of a vulnerable device.

The vulnerability of the Cisco Identity Services Engine’s network policy management web interface is related to access control errors based on role-based authorization RBAC. Exploiting this vulnerability could allow a malicious actor to remotely alter the configuration of the vulnerable device...

CloudBees Jenkins Role-based Authorization Strategy Plugin Privilege Obsolete Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Audit Trail Plugin is used in one of the audi...

Default configuration

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration...

CVE-2020-2286

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration...

CVE-2020-2286

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration...

CVE-2020-2286

Summary: CVE-2020-2286 affects Jenkins Role-based Authorization Strategy Plugin versions 3.0 and earlier. The vulnerability stems from not properly invalidating the permission cache when configuration changes, causing permissions to be granted based on an outdated policy. Affected component: Role...

CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

Access Restriction Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

Authorization

Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially exploit this vulnerability to read files in NAS server by directly interacting with certain APIs of Unity OE, bypassing Role-Based...

CVE-2018-1250

Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially exploit this vulnerability to read files in NAS server by directly interacting with certain APIs of Unity OE, bypassing Role-Based...

Cross site request forgery (csrf)

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...

CVE-2017-1000090

The CVE-2017-1000090 entry documents a CSRF flaw in the Jenkins Role-based Authorization Strategy Plugin. The root cause is that API requests were not required to be POSTed, allowing cross-site requests to alter authorization settings. Impact described across connected advisories: an attacker cou...

Red Hat PicketLink IDP ignores role based authorization

No description provided by source...

Red Hat PicketLink Privilege Bypass Vulnerability

Red Hat PicketLink is a unified identity management framework for Java applications. The 'invokeNextValve' function in the identity/federation/bindings/tomcat/idp/AbstractIDPValve.java file of Red Hat PicketLink failed to correctly Checking role-based authorization allows remote attackers to send...

CVE-2015-3158

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

Authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

CVE-2015-3158

CVE-2015-3158 affects PicketLink in Red Hat JBoss EAP 6.x where the invokeNextValve in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java fails to enforce role-based authorization. This allows remote authenticated users to access restricted resources via a direct request or an SP-initi...

PicketLink: PicketLink IDP ignores role based authorization

A flaw was found in the PicketLink Identity Provider Configuration IDP where, under specific conditions, the IDP ignores role-based authorization. This could lead to an authenticated user being able to access application resources that are not permitted for a given role...

PicketLink: PicketLink IDP ignores role based authorization

A flaw was found in the PicketLink Identity Provider Configuration IDP where, under specific conditions, the IDP ignores role-based authorization. This could lead to an authenticated user being able to access application resources that are not permitted for a given role...

PicketLink: PicketLink IDP ignores role based authorization

A flaw was found in the PicketLink Identity Provider Configuration IDP where, under specific conditions, the IDP ignores role-based authorization. This could lead to an authenticated user being able to access application resources that are not permitted for a given role...