4689 matches found
CVE-2019-11279 Privilege Escalation via Scope Manipulation in UAA
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls...
GnuCOBOL Resource Management Error Vulnerability
GnuCOBOL is a COBOL language compiler. A resource management error vulnerability exists in the 'endscopeofprogramname' function of the cobc/parser.y file in GnuCOBOL version 2.2, which arises from a networked system or product's improper management of system resources e.g., memory, disk space,...
DEBIAN-CVE-2019-16396
GnuCOBOL 2.2 has a use-after-free in the endscopeofprogramname function in cobc/parser.y via crafted COBOL source code...
UBUNTU-CVE-2019-16396
GnuCOBOL 2.2 has a use-after-free in the endscopeofprogramname function in cobc/parser.y via crafted COBOL source code...
GHSA-5W65-6875-RHQ8 Undefined Behavior in sailsjs-cacheman
All versions of sailsjs-cacheman have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave. Recommendation No fix is currently available. Consider using an alternative...
Undefined Behavior in sailsjs-cacheman
All versions of sailsjs-cacheman have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave. Recommendation No fix is currently available. Consider using an alternative...
CVE-2019-11279: Privilege Escalation via Scope Manipulation in UAA | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA Release All versions prior to v74.1.0 Description CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn’t be allowed by submitting an array of requested scopes. A remote malicious...
PT-2019-16409 · Mongodb +1 · Mongodb Server +2
Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 4.0.11 MongoDB Server versions prior to 3.6.14 MongoDB Server versions prior to 3.4.22 Description: The issue is related to incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts...
CVE-2019-11247 Kubernetes kube-apiserver allows access to custom resources via wrong scope
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...
CVE-2019-15325
In GalliumOS 3.0, CONFIGSECURITYYAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptracescope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not...
Mail.ru: Disable 2FA via CSRF (Leads to 2FA Bypass)
CSRF vulnerability in pandao.ru allowed to disable 2FA. pandao.ru belongs to extended scope...
PT-2019-12186 · Tibco · Tibco Api Exchange Gateway +1
Name of the Vulnerable Software and Affected Versions: TIBCO API Exchange Gateway versions 2.3.1 and prior versions TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.1 and prior versions Description: The authorization component of TIBCO API Exchange Gateway contains a...
CVE-2019-11270
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
Design/Logic Flaw
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
API server allows access to custom resources via wrong scope
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L The API server mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the...
Qualys Cloud Platform 2.40 New Features
This release of the Qualys Cloud Platform version 2.40 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning "Everything" Detection Scope – A new detection scope called "Everything" is now available in the option profile. This can be used ...
CVE-2019-11270: UAA clients.write vulnerability | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients wi...
Mail.ru: Information Disclosure - Получаем доступ к работам и к приватным презентациям к курсам
Access to course training materials was possible in Geekbrains due to read access to S3-compatible bucket. Geekbrains belongs to extended Ext. B scope...
CVE-2019-2316
CVE-2019-2316 concerns Qualcomm Snapdragon components where a local variable is used after it goes out of scope during digest computation in multiple Snapdragon platforms (MDM9640, QCS405, QCS605, SD 4xx/6xx/7xx series, 710/712/730/845/850/855, SDM660/SDX24, etc.). The root cause is a use-after-s...
CVE-2019-2316
When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730...