WS: EJB3 role restrictions are not applied to jaxws handlers

A flaw was found in the way method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers, and only class-level restrictions were applied. A remote attack...

【Bug fix】Report: 2 0 1 4 years Microsoft 9 7% of the vulnerabilities with administrator permissions for-vulnerability warning-the black bar safety net

This week, the British company called Avecto, a security company released a latest security Report, 2 0 1 4 year Microsoft released and repair of the 2 4 0 one security breach, more than 9 7 per cent with administrator privileges is the use of related. At the same time, the company to the user of...

Mandriva Linux Security Advisory : postgresql (MDVSA-2015:110)

Updated postgresql packages fix multiple security vulnerabilities : Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Government Report Critical of FAA Security Controls

The Federal Aviation Administration has been put on notice that its information security controls are not up to par and that a risk-based program must be implemented from the ground up in order to assure the safety of its networks and passengers in the sky. A scathing Government Accounting Office...

WordPress WP EasyCart Plugin Privilege Escalation

The WordPress WP EasyCart plugin from version 1.1.30 to 3.0.20 allows authenticated users of any user level to set any system option via a lack of validation in the ecajaxupdateoption and ecajaxclearalltaxrates functions located in /inc/admin/adminajaxfunctions.php. The module first changes the...

Fedora 20 : sudo-1.8.12-1.fc20 (2015-2247)

update to 1.8.12 - fixes CVE-2014-9680 Update to 1.8.11p2 Major upstream changes & fixes : - when running a command in the background, sudo will now forward SIGINFO to the command - the passwords in ldap.conf and ldap.secret may now be encoded in base64. - SELinux role changes are now audited...

WordPress WPLMS Theme Privilege Escalation

The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows an authenticated user of any user level to set any system option due to a lack of validation in the importdata function of /includes/func.php. The module first changes the admin e-mail address to prevent any notifications being sent t...

Quasar Theme Rock Form Builder plugin - Privilege Escalation

The Rock Form Builder plugin 1.0 is used within the Quasar WooCommerce theme 1.9.1. Authenticated users can modify WordPress settings which can lead to full site compromise. It's unclear which exact version of the rock-form-builder fixed the issue, but it was something in between 1.0 and 2.5, so...

Red Hat JBoss Enterprise Application Platform Role Based Access Control Component Security Bypass Vulnerability

Red Hat JBoss Enterprise Application Platform is an open source, J2EE-based middleware platform for building, deploying, and hosting Java applications and services.JBoss Application Server AS, also known as WildFly is an open source JavaEE-based application server; the JacORB subsystem is a...

Persistent Systems Radia Client Automation Remote Elevation of Privilege Vulnerability

Persistent Systems Radia Client Automation is a solution with superior manageability designed specifically for particularly complex and ever-changing enterprise client infrastructures. Persistent Systems Radia Client Automation fails to properly restrict access to certain requests, allowing remot...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

CVE-2015-1498

Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to 1 enumerate user accounts via a getUsers request, 2 assign a role to a user account via an addAssigneesToRole request, 3 remove a role from a user account via a...

Cross site request forgery (csrf)

Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to 1 enumerate user accounts via a getUsers request, 2 assign a role to a user account via an addAssigneesToRole request, 3 remove a role from a user account via a...

Securing DNS Essential to Web's Future, Dan Kaminsky

CANCUN – “2015 got weird… really weird.” Those were some of the first words spoken by Dan Kaminsky in his talk today at the Kaspersky Security Analyst Summit Monday. He was referring to a few key events from the last several weeks: the Sony hack debacle, or what he called “North Korean or...

CVE-2014-7849

The Role Based Access Control RBAC implementation in JBoss Enterprise Application Platform EAP 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer...

Authorization

The Role Based Access Control RBAC implementation in JBoss Enterprise Application Platform EAP 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer...

Management: Limited RBAC authorization bypass

It was discovered that the Role Based Access Control RBAC implementation did not sufficiently verify all authorization conditions that are required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role could use this flaw to add, modify, ...

Subsystem: Information disclosure via incorrect sensitivity classification of attribute

It was discovered that the JBoss Application Server WildFly JacORB subsystem incorrectly assigned socket-binding-ref sensitivity classification for the security-domain attribute. An authenticated user with a role that has access to attributes with socket-binding-ref and not security-domain-ref...