Android Camera convertToHidl Unauthorized Access

The vulnerability in the implementation of the convertToHidl function of the Camera component in Android operating systems is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2019-10127

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having...

Cybozu Office Operation Restriction Bypass Vulnerability

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operation restriction bypass vulnerability exists in the scheduler program in Cybozu Office. An attacker could use this vulnerability to alter data in the scheduler without proper privileges...

Cybozu Office Operation Restriction Bypass Vulnerability (CNVD-2021-18065)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operation restriction bypass vulnerability exists in the bulletin boards in Cybozu Office. An attacker could use this vulnerability to change the data in the bulletin board without proper privileges...

Cybozu Office Operation Restriction Bypass Vulnerability (CNVD-2021-18064)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operational restriction bypass vulnerability exists in the workflow in Cybozu Office. An attacker could exploit the vulnerability to alter workflow data without proper privileges...

Cisco Webex Meetings Desktop App Unauthorized Access

The vulnerability of the Cisco Webex Meetings Desktop App and Webex Productivity Tools software for web conferencing on Windows operating systems is related to errors in handling requests. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information by...

CVE-2021-22853

The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work...

Design/Logic Flaw

Calsos CSDJ CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors...

CVE-2021-20653

CVE-2021-20653 affects NEC Calsos CSDJ (B 01.08.00 and earlier, H 01.08.00 and earlier, D 01.08.00 and earlier, A 03.08.00 and earlier). The issue is a permission check bypass (CWE-264) that may allow an authenticated user to view unauthorized historical data without proper access. Root cause is ...

CVE-2021-20653: Incorrect Default Permissions

Calsos CSDJ CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors...

SQLite Buffer Overflow Info Disclosure

The vulnerability of the SQLite database management system is related to writing data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2021-21511: Improper Authorization

Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote low privileged attacker could potentially exploit this vulnerability, to gain unauthorized read or modification access to other users' backup data...

CVE-2021-21016 Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2021-21027 Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a cross-site request forgery CSRF vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the...

CVE-2021-21015 Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required...

PT-2021-2039 · Microsoft · Dataverse

Name of the Vulnerable Software and Affected Versions: Microsoft Dataverse affected versions not specified Description: The issue is related to insufficient input validation. It may allow a remote attacker to gain unauthorized access to protected information. Recommendations: At the moment, there...

Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2021-1198)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Configurator UI Servlet Unauthorized Access

The vulnerability of the UI Servlet component of the Oracle Configurator is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information or to read, modify, add, or delete data using the...

WebExtensions Framework Unauthorized Access

The vulnerability of the API for searching WebExtensions extensions in the Mozilla Firefox browser is related to an execution error when searching certain privileged pages, such as “about: debugging”. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protect...

Oracle Application Express Opportunity Tracker Access Control

The vulnerability of the Oracle Application Express Opportunity Tracker sales management application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to modify, add, or delete data using the HTTP protocol...