Security feature bypass

An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions...

CVE-2019-19585

An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions...

KLA11646 Multiple vulnerabilities in Oracle JRE

Multiple vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to obtain sensitive information. Below is a complete list of vulnerabilities: 1. Vulnerability in JSSE component of Java SE can be exploited remotely to obtain sensitive information, bypass...

KLA11641 Multiple vulnerabilities in Oracle VirtualBox

Multiple vulnerabilities were found in Oracle VirtualBox. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Vulnerability in Core component of Oracle VM VirtualB...

GitLab: Private objects exposed through project import

Summary This is a bypass of https://hackerone.com/reports/743953 , the current fix is blocking all "ids" attributes. However an attacker could still set attributes like issueids by indrectly settings the field within the attributes field it self: project.json "attributes": "issueids": 29279725 ,...

AppLocker Policy Bypass

Exploit Title: AppLocker 'Packaged App' Installation Policy Bypass Date: 2/1/20 Exploit Author: Social Engineering Neo - @EngineeringNeo Vendor Homepage: https://microsoft.com Software Link: N/A Version: Windows build 18363.535 and below. Tested on: Windows 10 build 17763.253, 18362.295, 18362.35...

Security feature bypass

gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue...

CVE-2013-4976

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

CVE-2013-4982

AVTECH AVN801 DVR has a security bypass via the administration login captcha...

Hardcoded credentials

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

Design/Logic Flaw

AVTECH AVN801 DVR has a security bypass via the administration login captcha...

CVE-2013-4982

CVE-2013-4982 affects AVTECH AVN801 DVRs; authentication bypass is possible by using the login=quick parameter to bypass the login verification code, potentially granting unauthorized access to feeds or device settings. The issue stems from bypassing the admin login captcha, enabling access witho...

CVE-2013-4982

AVTECH AVN801 DVR has a security bypass via the administration login captcha...

CVE-2013-4976

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

CVE-2013-4976

CVE-2013-4976 affects Hikvision DS-2CD7153-E IP Cameras, enabling security bypass via hardcoded credentials (remote authentication bypass). The NVD entry lists high/severe impact with CVSS v3.1 base score 9.8 (NETWORK, NONE prerequisites, US S) and CVSS v2 base score 7.5, indicating critical risk...

CVE-2019-20043

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this...

Microsoft Exchange Server '/Autodiscover' Server Side Request Forgery Security Bypass Vulnerability

Description Microsoft Exchange Server is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. Microsoft Exchange Server 2013 Cumulative Update 22 and prior versions are...

The vulnerability of the YARN NodeManager component in Apache Hadoop’s distributed development and execution platform allows attackers to circumvent existing security restrictions and introduce malicious code into a zip file.

The vulnerability of the YARN NodeManager component in Apache Hadoop distributed development and execution platforms exists due to an incorrect pathname limitation for the restricted access directory. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions...

Unspecified Vulnerability in Apple iOS and iPadOS Screen Recording Component

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Screen Recording in Apple iOS before 13.2 and Apple iPadOS before 13.2. An...

CVE-2019-16453

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution...