GHSA-HWHH-2FWM-CFGW Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

Symantec (Blue Coat) ProxySG 6.5.x < 6.5.10.6 / 6.6.x < 6.6.5.8 / 6.7.x < 6.7.1.2 Impromper User Authorization Vulnerability

The self-reported version of the remote Symantec Blue Coat ProxySG device is 6.5.x prior to 6.5.10.6, 6.6.x prior to 6.6.5.8, or 6.7.x prior to 6.7.1.2. It is, therefore, affected by an improper user authorization vulnerability in web-based management console. C Tenable Network Security, Inc...

SA146: Improper User Authorization in ProxySG and ASG

SUMMARY The ProxySG and ASG management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges...

Paragon Initiative Enterprises: Improper access control lead To delete anyone comment

SUMMURY ======================== Here server dont check the owner of any comment. During Comment deletion it does not check whether the comment is created by user or not. so i can delete a comment of others user. STEP TO REPRODUCE ======================= 1. goto https://localhost:8080/blog/commen...

Pirate Bay Spotted Hosting Monero Cryptocurrency Miner

A cryptocurrency miner surfaced on the world’s largest torrenting site for a day over the weekend, raising the ire of users unaware the tool was there, let alone leveraging their machine’s computing power. Users noticed the miner Friday night on The Pirate Bay, a site that acts as a treasure trov...

Citrix App Layering: Recipe IBM SPSS 21

Licensing Considerations The following information should be discussed with your IBM licensing contacts: Concurrent user network licensing for IBM SPSS packages. Usage of SPSS in a virtualized environment requires a licensing “addendum” and further cost. A physical server with current Java versio...

Pornhub: [idor] Profile Admin can pin any other user's post on his stream wall

The researcher discovered a vulnerability where a user may pin and post other users' content to their stream without their authorization...

RHEL 6 : JBoss EAP (RHSA-2015:2542)

Updated jboss-ec2-eap packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat JBoss Enterprise Application Platform 6.4.4 on Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Critical security impact. Commo...

For the recent Bosch global eye OAuth vulnerability analysis and preventive recommendations-vulnerability warning-the black bar safety net

According to CnetreportsSingapore Nanyang Technological University, a man named Wang Jing PhD student, found that the OAuth and OpenID open source login tools the“covert redirect”vulnerabilityCovert Redirect to. First of all need to clear point is that the vulnerability is not present in the OAut...

Huawei eSpace Meeting Service 1.0.0.23 Privilege Escalation

Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation Vendor: Huawei Technologies Co., Ltd. Product web page: http://www.huawei.com Affected version: 1.0.0.23 V100R001C03SPC201B050 Summary: Huawei's eSpace Meeting solution fully meets the needs of enterprise customers for...

PT-2013-54: Access Restrictions Bypassing in Huawei SGSN USN9810

The specialists of the Positive Research center have detected an Access Restrictions Bypassing vulnerability in Huawei SGSN USN9810. The application does not sufficiently check the user’s authorization in the system. This allows an authorized attacker to obtain access to various administrative...

OpenStack security vulnerabilities

User authorization vulnerabilities...

sudo security update

CentOS Errata and Security Advisory CESA-2012:1081 An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS...

CVE-2011-1378

IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File UAF data, which allows local users to kill listener processes and the command server via a control command...

CVE-2011-1378

IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File UAF data, which allows local users to kill listener processes and the command server via a control command...

Fedora Update for sepostgresql FEDORA-2010-15870

Check for the Version of sepostgresql OpenVAS Vulnerability Test Fedora Update for sepostgresql FEDORA-2010-15870 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for sepostgresql FEDORA-2010-16004

Check for the Version of sepostgresql OpenVAS Vulnerability Test Fedora Update for sepostgresql FEDORA-2010-16004 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

[SECURITY] Fedora 14 Update: sepostgresql-9.0.1-20101007.fc14

Security Enhanced PostgreSQL is an extension of PostgreSQL based on SELinux security policy, that applies fine grained mandatory access control to many objects within the database, and takes advantage of user authorization integrated within the operating system. SE-PostgreSQL works as a userspace...

[SECURITY] Fedora 13 Update: sepostgresql-9.0.1-20101007.fc13

Security Enhanced PostgreSQL is an extension of PostgreSQL based on SELinux security policy, that applies fine grained mandatory access control to many objects within the database, and takes advantage of user authorization integrated within the operating system. SE-PostgreSQL works as a userspace...

Important: Red Hat Security Advisory: sudo security update

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...