CVE-2019-19885

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0...

USN-4536-1: SPIP vulnerabilities

Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2019-16392 Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could...

CVE-2020-3374 Cisco SD-WAN vManage Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...

(0Day) (Pwn2Own) Apple macOS Quarantine Attribute Bypass Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of download...

CVE-2020-10134

Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user erroneously completes both pairing procedure...

ZSQL: Check for users with DROP USER permission

Searches for users and roles with DROP USER permission and checks whether they are authorized to have it. A user with the DROP User permission can delete other users. If this permission is no longer necessary, revoke it. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be...

CVE-2019-8502

An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization...

Authorization

An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization...

CVE-2019-8502

An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization...

Adive Framework 2.0.7 - Privilege Escalation Exploit

Exploit for php platform in category web applications Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE :...

ALPINE-CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

Apple iOS, tvOS and macOS Mojave Siri API Vulnerabilities

Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple macOS Mojave is a specialized operating system developed for Mac computers.Siri is a voice control component of it. A security vulnerability exists in the processing of command requests f...

No-Cms 1.0 SQL Injection

Exploit Title: No-Cms 1.0 - 'orderby' SQL Injection Date: 2018-11-28 Exploit Author: Loading Kura Kura Vendor Homepage: https://github.com/goFrendiAsgard/No-CMS Software Link: https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master Tested on: Win10/Kali Linux Google Dork: n/a Version: n/a CV...

No-Cms 1.0 - order_by SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: No-Cms 1.0 - 'orderby' SQL Injection Exploit Author: Loading Kura Kura Vendor Homepage: https://github.com/goFrendiAsgard/No-CMS Software Link: https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master Tested on: Win10/Kali...

No-Cms 1.0 - order_by SQL Injection

No-Cms 1.0 - orderby SQL Injection Exploit Title: No-Cms 1.0 - 'orderby' SQL Injection Date: 2018-11-28 Exploit Author: Loading Kura Kura Vendor Homepage: https://github.com/goFrendiAsgard/No-CMS Software Link: https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master Tested on: Win10/Kali Lin...

Code injection

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

Privilege Escalation

aedes is susceptible to privilege escalation. The vulnerability is possible because the authorization of user is not validated to publish a LWT in a channel...

CVE-2018-5489

NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administrators or privileged users. 7MTT versions below 2.0 do not enforce user authorization rules on file information and status that it has...

Unable to access NetScaler MAS 12 using LDAP authentication with the error "User not authorised for any operation"

Unable to access NetScaler MAS using LDAP authentication with the error "User not authorized for any operation"...

Security Bulletin: IBM QRadar SIEM is vulnerable to a client side scripting attack due to a missing HTTPOnly flag on a cookie. (CVE-2015-1994)

Summary One of the cookies used for user authorization is missing the HTTPOnly Attribute which allows attackers leveraging a Cross-Site Scripting vulnerability to obtain the cookie value and then perform a session hijacking attack. Vulnerability Details CVE-ID: CVE-2015-1994 Description: IBM QRad...