Elasticsearch MachineLearning XML External Entities (CVE-2018-17247)

An XML external entities vulnerability exists in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the...

CVE-2020-9522

Cross Site Scripting XSS vulnerability in Micro Focus ArcSight Enterprise Security Manager ESM product, Affecting versions 7.0.x, 7.2 and 7.2.1 . The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting XSS or information disclosure...

GHSA-XXGP-PCFC-3VGC Privilege Escalation in Hibernate Validator

In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege...

Privilege Escalation in Hibernate Validator

In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege...

Micro Focus ArcSight Enterprise Security Manager Cross-Site Scripting Vulnerability

Micro Focus ArcSight Enterprise Security Manager is a suite of enterprise security management software with event correlation and security analytics from Micro Focus, UK. The software collects, correlates and reports on enterprise-wide security events in real time so that anomalous or unauthorize...

Trend Micro Deep Security Manager Installed (Windows)

Binary data trendmicrodeepsecuritymanagerwininstalled.nbin...

Authorization Bypass

java is vulnerable to authorization bypass. The vulnerability exists as it was found that JNLPSecurityManager could silently return without throwing an exception when permission was denied. If the javaws command was used to launch a Java Web Start application that relies on this exception being...

Symantec Data Center Security Manager Privilege Escalation

Symantec Data Center Security Manager Component, with versions earlier than 6.8.2 aka 6.8 MP2, are found to be susceptible to a privilege escalation vulnerability, where an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected...

CVE-2017-7536

It was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an...

Broadcom Symantec Data Center Security Manager Component Elevation of Privilege Vulnerability

Broadcom Symantec Data Center Security Manager Component is a data protection solution from Broadcom, Inc. A security vulnerability exists in Broadcom Symantec Data Center Security Manager Component versions prior to 6.8.2. An attacker could exploit this vulnerability to gain elevated privileges...

Privilege escalation

Symantec Data Center Security Manager Component, prior to 6.8.2 aka 6.8 MP2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected...

Data Center Security Privilege Escalation

Summary Symantec has released an update to address an issue that was discovered in the Data Center Security Manager component. Affected Products Data Center Security Manager Component --- CVE | Affected Versions | Remediation CVE-2020-5832 | Prior to 6.8.2 aka 6.8 MP2 | Upgrade 6.8.2 aka 6.8 MP2...

Cisco Security Manager Insecure Deserialization (CVE-2019-12630)

An insecure deserialization vulnerability exists in Cisco Security Manager. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system...

Privilege Escalation

java-ibm is vulnerable to privilege escalation. An attacker is able to gain higher privileges through the ability to execute code in the context of a security manager...

Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape

Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape Exploit Title: Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape Date: 2020-01-07 Exploit Author: Harrison Neal, PatchAdvisor Vendor Homepage: https://tomcat.apache.org/ Software Link:...

CVE-2019-14843

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss E...

CVE-2019-14843

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss E...

Design/Logic Flaw

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss E...

CVE-2019-14843

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss E...

CVE-2019-14843

CVE-2019-14843 affects Red Hat JBoss Enterprise Application Platform (EAP) 7.x running WildFly-based Security Manager under JDK 8/11, enabling authorization bypass that could expose unauthorized information. Connected advisories confirm this vulnerability (e.g., RHSA-2024:5856) and list a securit...