CVE-2021-23175

NVIDIA GeForce Experience vulnerability CVE-2021-23175 is a local privilege escalation in GameStream caused by improper per-user access controls. Affects GeForce Experience prior to version 3.24.0.126; with user intervention, may allow escalation of privileges, information disclosure, data tamper...

Security Bulletin: NVIDIA GeForce Experience - December 2021

NVIDIA has released a software security update for NVIDIA® GeForce Experience™ software. This update addresses an issue that may lead to multiple security impacts. To protect your system, download and install this software update through the GeForce Experience Downloads page, or open the client t...

CVE-2021-22866

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

Authorization

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

CVE-2021-22866 UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resources

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

CVE-2021-22866

The CVE describes a UI misrepresentation in GitHub Enterprise Server’s GitHub App authorization flow. A user could grant more permissions than shown if the App had additional user-level permissions added after initial approval, by revisiting the authorization flow. Affected products/versions: Git...

CVE-2021-22866: User Interface (UI) Misrepresentation of Critical Information

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

PT-2021-15239

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 2.22.x prior to 2.22.13 GitHub Enterprise Server versions 3.0.x prior to 3.0.7 Description A UI misrepresentation issue was identified that allowed more permissions to be granted during a GitHub App's...

CVE-2021-22858

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

Cisco SD-WAN vManage Information Disclosure (cisco-sa-sdwan-vinfdis-MC8L58dj)

According to its self-reported version, Cisco SD-WAN vManage is affected by an information disclosure vulnerability due to insufficient user authorization. An authenticated, local attacker can exploit this, by accessing the vshell of an affected system, to read database files from the filesystem ...

CVE-2021-1235

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an...

PT-2021-1836

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software affected versions not specified Description A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The issu...

CVE-2021-1235: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an...

CVE-2021-21448

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on th...

CVE-2021-21448

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on th...

Authorization

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on th...

CVE-2018-20802

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3...

CVE-2019-19885

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0...

Authorization

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0...

CVE-2019-19885

CVE-2019-19885 affects Bender COMTRAXX devices (COM465IP, COM465DP, COM465ID, CP700, CP907, CP915) prior to version 4.2.0. Root cause: user authorization is validated for most routes but not all; a user who knows the routes can read and write configuration data without prior authorization. Impact...