3513 matches found
CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
CVE-2017-6919
CVE-2017-6919 affects Drupal 8 where, if RESTful Web Services (rest) is enabled and PATCH requests are allowed, an authenticated user can bypass access controls. Affected versions are Drupal 8 up to 8.2.8 and 8.3 up to 8.3.1. The underlying issue is a critical access bypass in the REST module, en...
CVE-2017-2412
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle attackers to modify the client-server data stream to iTunes sandbox web services by leveraging use of cleartext HTTP...
AXIS Cross Site Request Forgery / Cross Site Scripting Vulnerabilities
Exploit for hardware platform in category web applications Introduction ============ Vulnerabilities were identified in the camera software by Axis. These were discovered during a black box assessment and therefore the vulnerability list should not be considered exhaustive; observations suggest...
Microsoft Browser Spoofing Vulnerability
A spoofing vulnerability exists when Microsoft browsers do not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a...
Microsoft Browser Spoofing Vulnerability
A spoofing vulnerability exists when Microsoft browsers do not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a...
USN-3220-3 linux-aws vulnerability
USN-3220-1 fixed a vulnerability in the Linux kernel. This update provides the corresponding updates for the Linux kernel for Amazon Web Services AWS. Alexander Popov discovered that the NHDLC line discipline implementation in the Linux kernel contained a double-free vulnerability. A local attack...
Ubuntu: Security Advisory (USN-3220-3)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
UBUNTU-CVE-2017-6471
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by validating the capability length...
CVE-2016-8643
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
CVE-2016-8643
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
CVE-2016-8643
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
Code injection
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
UBUNTU-CVE-2016-8643
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
CVE-2016-8643
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
CVE-2016-8643
Technical details (affected product/version, root cause, impact, and fixes) are not publicly provided in the supplied documents. Please monitor for updates from vendors and security bodies.
Cross site request forgery (csrf)
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request...
CVE-2016-10086
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request...
CVE-2016-10086
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request...