2304 matches found
openstack-keystone: Incorrect role assignment with federated Keystone
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...
Qualys Cloud Suite 8.10.1 New Features
This new patch release of the Qualys Cloud Suite, version 8.10.1, includes updates to password management, user roles & permissions, and User Defined Control improvements in Qualys Policy Compliance PC. Feature Highlights Qualys Cloud Platform Platform Password Improvements - In this release, we...
openstack-keystone: Incorrect role assignment with federated Keystone
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...
CVE-2017-2673
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...
UBUNTU-CVE-2017-2673
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...
PT-2017-15467 · Openstack +1 · Openstack Identity Service +1
Name of the Vulnerable Software and Affected Versions: OpenStack Identity service keystone affected versions not specified Description: An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service. This issue allows an authenticated federated user to...
Automated Security Response: Falcon Orchestrator
CrowdStrike Falcon Orchestrator is an extendable Windows-based application that provides workflow automation, case management and security response functionality. The tool leverages the highly extensible APIs contained within the CrowdStrike Falcon Connect program. Falcon Orchestrator has only be...
IBM WebSphere Application Server 8.5 < 8.5.5.6 Multiple Vulnerabilities (FREAK)
Binary data 9716.prm...
Updated drupal packages fix security vulnerabilities
Updated drupal packages fix security vulnerability: A vulnerability exists in the User module, where if some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can be granted all user roles on the site. This would typically result in the user gainin...
WordPress Plugin Premium SEO Pack 1.9.1.3 - wp_options Overwrite
WordPress Plugin Premium SEO Pack 1.9.1.3 - wpoptions Overwrite Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-002...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-002...
drupal -- multiple vulnerabilities
Drupal Security Team reports: Saving user accounts can sometimes grant the user all roles User module - Drupal 7 - Moderately Critical Views can allow unauthorized users to see Statistics information Views module - Drupal 8 - Less Critical...
The vulnerability of the PostgreSQL database management system allows attackers to circumvent existing access restrictions.
The vulnerability of the PostgreSQL database management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using a session that executes queries from more than one role...
PostgreSQL Security Bypass Vulnerability (CNVD-2016-02169)
PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A security bypass vulnerability exists in PostgreSQL...
IBM WebSphere Application Server Privilege Escalation Vulnerability (Apr 2016)
IBM WebSphere Application Server is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
"server signing = mandatory" not enforced
Description Due to a regression introduced in Samba 4.0.0, an explicit "server signing = mandatory" in the global section of the smb.conf was not enforced for clients using the SMB1 protocol. As a result it does not enforce smb signing and allows man in the middle attacks. This problem applies to...
Drupal Core Information Disclosure Vulnerability (CNVD-2016-01932)
Drupal is a free and open source content management system developed in PHP. Drupal Core has a security vulnerability. Depending on the data that has been added to the form or saved before the array, allows an attacker can lead to a user to get all the roles on the site...
EMC Documentum xCP Information Disclosure Vulnerability
EMC Documentum xCP is a development platform from EMC that uses automated information-intensive processes to help users make business decisions. The platform provides real-time visibility, content analytics and business insights. A security vulnerability exists in the members/xcpmember API in EMC...