The vulnerability of the Apache Spark framework, related to deficiencies in the authentication process, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Apache Spark framework is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the anti-spam protection mechanism of the Cisco Email Security Appliance (ESA) allows attackers to bypass the configured content filters and compromise the integrity of the protected information.

The vulnerability of the anti-spam protection mechanism of Cisco Email Security Appliance relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass the configured content filters and compromise the integrity of the protected information...

The vulnerability of the SharePort Web Access function in D-Link router microprogramming products such as D-Link DIR-868L, D-Link DIR-885L, and D-Link DIR-895L allows attackers to enhance their privileges.

The vulnerability of the SharePort Web Access function in D-Link router microprogramming products such as D-Link DIR-868L, D-Link DIR-885L, and D-Link DIR-895L is related to authentication deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

CVE-2020-1786

HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175C00E69R3P8 have an improper authentication vulnerability. The software does not sufficiently validate the name of apk file in a special condition which could allow an attacker to forge a crafted application as a normal one. Successful...

Genasys Technologies: Improper Input Validation on payment page

Executive Summary ===================== All activities were conducted against Genasys Technologies with the goals of: • Identifying if a remote attacker could penetrate Genasys Technologies defenses • Determining the impact of a security breach on: • Confidentiality of the company’s private data...

MailStore Server and Service Provider Edition Authorization Issues Vulnerability

MailStore Server is a set of email storage solutions from MailStore Germany. The product is mainly used for email archiving, email management and email storage functions.MailStore Server Service Provider Edition is the service edition of MailStore Server. An authorization issue vulnerability exis...

The vulnerability of the ABAP Debugger arises from deficiencies in the authentication process, allowing an attacker to execute the “Go to statement” without going through the authentication process.

The vulnerability of the ABAP Debugger is due to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute the “Go to statement” without going through the authentication process...

CloudBees Jenkins Build Failure Analyzer Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins Build Failure Analyzer Plugin 1.24.1 and prior versions. The vulnerability stems from a lack of...

Design/Logic Flaw

An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency DTMF tone to invoke an access grant that would allow physical access to a restricted floor/level. By design, only a residential unit owner may allow such an...

CVE-2017-16778

CVE-2017-16778 describes an access-control weakness in the DTMF tone receiver of the Fermax Outdoor Panel. Due to incorrect access-control logic, an attacker could inject a DTMF tone via the speaker unit to trigger an access grant and gain unauthorized physical access to a restricted floor/level....

SonicWall Email Security Appliance Authorization Issues Vulnerability

SonicWall Email Security Appliance is an email security appliance from SonicWall USA. An authorization issue vulnerability exists in SonicWall Email Security Appliance version 10.0.2 and earlier. The vulnerability stems from a lack of authentication measures or insufficient authentication strengt...

CVE-2019-18263

An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity 718132 with wireless option shipped between 2016-August 2018, Veradius Unity 718132 with ViewForum option shipped between 2016-August 2018, Pulsera 718095 and Endura 718075 with wireless option shipp...

CVE-2019-11086

Insufficient input validation in subsystem for IntelR AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

Code injection

IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 168510...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling External Authentication Server (CVE-2015-7575, CVE-2016-0475, CVE-2015-4872, CVE-2015-5006)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7.0 that is used by IBM Sterling External Authentication Server. These issues were disclosed as part of the IBM Java Runtime updates in October 2015 and January 2016 and include the...

Kernel: page cache side channel attacks

A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...

The vulnerability of the Server:Optimizer component of the Oracle MySQL database management system allows a hacker to cause a service failure.

The vulnerability of the Server:Optimizer component of the Oracle MySQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL network protocol...

The authentication system’s vulnerability for web applications related to incorrect authorization allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the authentication system for web applications provided by LemonLDAP::NG stems from improper authorization conditions. This occurs when the relay party using OIDC has weaker access control rules than the target RP, and there is no URI filtering. Exploiting this vulnerability...

chromium-browser: Insufficient policy enforcement in developer tools

Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

The vulnerability of the driver for the hardware abstraction layer of the MEinfo utility lies in the Microprogramming Software Intel Converged Security and Manageability Engine (CSME), the Microprogramming Software Intel Trusted Execution Engine (TXE), the Intel-SA-00086 Detection Tool, and the INTEL-SA-00125 Detection Tool. This vulnerability allows attackers to enhance their privileges.

The vulnerability of the MEinfo driver for hardware abstraction in Intel Converged Security and Manageability Engine CSME microprogramming software, Intel Trusted Execution Engine TXE microprogramming software, Intel-SA-00086 Detection Tool, and INTEL-SA-00125 Detection Tool is related to...