An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2.


An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to address bar spoofing.


An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1 Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.


An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead to address bar spoofing.


An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical access to an iOS device may be able to access stored passwords without authentication.


An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical access to an iOS device may be able to access contacts from the lock screen.


Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306 and access sensitive information from the device.


Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.


Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring \success\ when an arbitrary password is provided.


Incorrect access control in the WebUI in OPNsense before version 19.1.8 and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.


Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers.


Incorrect access control in the CxUtilSvc component of the Synaptics Sound Device drivers prior to version 2.29 allows a local attacker to increase access privileges to the Windows Registry via an unpublished API.


Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent.


Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.


Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view.


Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force.


Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server.


Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter.


Incorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to compromise authentication keys and access and manipulate security relevant configurations via unrestricted database access during Easy Enrollment.


Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.


Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request.


Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information.


Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password.


Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.


Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds.


Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.


Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.


Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information.


Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.


Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the \name\ URL parameter.


Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the \name\ URL parameter.


Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers and to guess document attribute values via crafted parameters.


Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.


Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator console without authentication.


Incorrect

Access

Control

in

Autumn

and

earlier

allows

remote

attackers

to

obtain

clear-text

login

credentials

via

the

component

\autumn-cms/user/getAllUser/?page=1&limit=10\.


Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in \/index.php\ by manipulating the parameter \user_id\ in the HTML request.


Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout which allows for replaying packets.


Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.


Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.


Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php.


Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header.


Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation.


OX App Suite through 7.10.2 has Incorrect Access Control.


Privilege escalation in McAfee Enterprise Security Manager (ESM) 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control.


An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently an attacker can achieve a denial-of-service attack without authentication.


An issue was discovered in GitLab Community and Enterprise Edition 9.x 10.x and 11.x before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group if their privileges within the project are different from the group.


An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10 11.6.x before 11.6.8 and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information.


An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN without authentication via the SetWanSettings HNAP API.


An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9) 9.x 10.x and 11.x before 11.5.9 11.6.x before 11.6.7 and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.


An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects.


An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.


HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE then it is possible to impersonate another user to the condor_schedd. (For example to submit or remove jobs)


Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.


An issue was discovered in GitLab Community and Enterprise Edition 8.x 9.x 10.x and 11.x before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.


An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users.


ChinaMobile

PLC

Wireless

Router

devices

with

firmware

have

an

Incorrect

Access

Control

vulnerability

via

the

cgi-bin/webproc?getpage=html/index.html

subpage=wlsecurity

URI

allowing

an

Attacker

to

change

the

Wireless

Security

Password.


An issue was discovered in GitLab Community and Enterprise Edition 9.x 10.x and 11.x before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.


An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user if the file size and OID are known.


Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS QoS RIP and other privileged configurations (intended only for the network operator) by sending an HTTP POST to the PHP backend because the page filtering for non-superuser (in header.php) is done only for GET requests and not for direct AJAX calls.


An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.


Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.


An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests.


An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported it will retain its prior visibility.


An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles.


An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11 11.4.x before 11.4.8 and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.


An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control.


An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.


An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user group and repository metadata to unauthorized users. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments the comments section would become inaccessible. It has Incorrect Access Control (issue 1 of 2).


Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a maliciously modified POST (HTTP) request containing shell commands which will be executed on the device to an backend API endpoint of the cable modem.


An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication allowing for potential account takeover.


An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control.


An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter.


An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2 1.31.2 1.30.2 and 1.27.6.


An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8 11.8.x before 11.8.4 and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.


Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.1) allows attackers to view an RTSP stream by connecting to the stream with hidden credentials (guest or user) that are neither displayed nor configurable in the camera's CamHi or keye mobile management application. This affects certain devices labeled as HI3510 HI3518 LOOSAFE LEVCOECAM Sywstoda BESDER WUSONGLUSAN GADINAN Unitoptek ESCAM etc.


An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.


Saleor

Issue

was

introduced

by

merge

commit:

This

commit

was

released

as

part

of

release

is

affected

by:

Incorrect

Access

Control.

The

impact

is:

Important.

The

component

is:

ProductVariant

type

in

GraphQL

API.

The

attack

vector

is:

Unauthenticated

user

can

access

the

GraphQL

API

(which

is

by

default

publicly

exposed

under

`/graphql/`

URL)

and

fetch

products

data

which

may

include

admin-restricted

shop's

revenue

data.

The

fixed

version

is:


Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.


Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.


ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulnerable to an unauthenticated remote reboot due. The component is: Reboot settings are available to unauthenticated users instead of only authenticaed users. The attack vector is: Remote.


LineageOS

and

earlier

is

affected

by:

Incorrect

Access

Control.

The

impact

is:

The

property

checked

by

`adb

root`

can

also

be

set

in

a

normal

adb

shell

session.

The

component

is:

adb

shell

(patches

to

fix

this

are

at

The

attack

vector

is:

When

adb

is

enabled

and

an

attacker

has

physical

access

`adb

shell

setprop

service.adb.root

allows

restarting

adb

as

root.


Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registers. The component is: ioctl handling. The attack vector is: An attacker could exploit a bug in ioctl interface whitelist checking in order to write to model specific registers normally a function reserved for the root user. The fixed version is: v1.2.0.


Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-Priv Users to Elevate Privileges to Full Admin Rights via a crafted HTTP PUT Request as demonstrated by modified JSON data to a /v2/rest/ URI.


Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay as demonstrated by a login-link from the browser history.


An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.


An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make requests as an admin.


An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control a different vulnerability than CVE-2019-9732.


An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).


An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).


Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates (used for initiating a VPN session to the Alarm.com infrastructure) on the local camera device.


An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 3 of 5).


An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 5 of 5).


An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5).


An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10 11.7.x before 11.7.6 and 11.8.x before 11.8.1. It has Incorrect Access Control.


An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9 12.1.x before 12.1.9 and 12.2.x before 12.2.5. It has Incorrect Access Control.


Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to \any\ repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3 1.7.0-rc2.


Chamilo

Chamilo-lms

version

and

earlier

contains

an

Incorrect

Access

Control

vulnerability

in

Tickets

component

that

can

result

in

an

authenticated

user

can

read

all

tickets

available

on

the

platform

due

to

lack

of

access

controls.

This

attack

appears

to

be

exploitable

via

number.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.


slixmpp

version

before

commit

contains

an

incorrect

Access

Control

vulnerability

in

plugin

(Persistent

Storage

of

Private

Data

via

PubSub)

options

profile

used

for

the

configuration

of

default

access

model

that

can

result

in

all

of

the

contacts

of

the

victim

can

see

private

data

having

been

published

to

a

PEP

node.

This

attack

appears

to

be

exploitable

if

the

user

of

this

library

publishes

any

private

data

on

PEP

the

node

isn't

configured

to

be

private.

This

vulnerability

appears

to

have

been

fixed

in

commit

which

is

included

in

slixmpp


An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead.


Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character which might cause a developer to implement incorrect access control because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e. possibly greater than expected permissions).


The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6 7.x before 7.3.10 and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.


The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.


An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).


D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us) when setting PPPoE will start quagga process in the way of whole network monitoring and this function uses the original default password and port. An attacker can easily use telnet to log in modify routing information monitor the traffic of all devices under the router hijack DNS and phishing attacks. In addition this interface is likely to be questioned by customers as a backdoor because the interface should not be exposed.


An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.


Multiple versions of GlobalProtect-openconnect are affected by incorrect access control in GPService through DBUS GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the `--script=<script>` parameter.


Multiple versions of GlobalProtect-openconnect are affected by incorrect access control in GPService through DBUS GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server the attack can redirect the entire host's traffic via their own server.


Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read write and possibly even execute code inside the containers.


The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability an unauthenticated attacker can register an account bypassing the permission check of this portal's API. Then the attacker can then manipulate and read data of every registered patient.


An

incorrect

access

control

vulnerability

exists

in

Sourcecodester

Engineers

Online

Portal

in

PHP

in

nia_munoz_monitoring_system/admin/uploads.

An

attacker

can

leverage

this

vulnerability

in

order

to

bypass

access

controls

and

access

all

the

files

uploaded

to

the

web

server

without

the

need

of

authentication

or

authorization.


Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any guest users) thereby allowing privilege escalation unauthorized password reset stealing of sensitive data access to credentials in plaintext access to registry values tampering with configuration files etc.


** DISPUTED ** Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication OPA/Gatekeeper does not wait for the replication to finish before processing a request which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability because Kubernetes states are only eventually consistent.


SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.


An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript you can directly access the administrator console.


An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\\user.php.


HashiCorp Consul Enterprise before 1.8.17 1.9.x before 1.9.11 and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.


Incorrect access control in zam64.sys zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \\.\\ZemanaAntiMalware register with the driver using IOCTL 0x80002010 and send these IOCTL's to escalate privileges by overwriting the boot sector or overwriting critical code in the pagefile.


PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization a user can keep his admin privileges even if he is downgraded to the \user\ privilege. Even after a user's account is deleted the user can still access the administration panel (and add or delete users) and has complete access to the system.


Incorrect access control in zam64.sys zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \\.\\ZemanaAntiMalware register itself with the driver by sending IOCTL 0x80002010 allocate executable memory using a flaw in IOCTL 0x80002040 install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018 this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.


An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names (such as constructor or hasOwnProperty) to convince the System that the supplied API Key exists in the underlying JS object and consequently achieve complete access to User/Admin/Super API functions as demonstrated by a /super/constructor/accounts/list URI.


Trusted Firmware-M (TF-M) 1.4.0 when Profile Small is used has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example there is no authorization check associated with the relationship between a caller and a key owner.


Automotive Grade Linux Kooky Koi 11.0.0 11.0.1 11.0.2 11.0.3 11.0.4 and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required.


Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by \writing\ it on a token using the Yubico Personalization Tool they can then upload the new configuration to Yubicos OTP validation servers.


An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.


An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.


An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal.


An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (DTMF) tone to invoke an access grant that would allow physical access to a restricted floor/level. By design only a residential unit owner may allow such an access grant. However due to incorrect access control an attacker could inject it via the speaker unit to perform an access grant to gain unauthorized access as demonstrated by a loud DTMF tone representing '1' and a long '#' (697 Hz and 1209 Hz followed by 941 Hz and 1477 Hz).


Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00) enables remote attackers to execute door controller commands (e.g. lock unlock add ID card value) by sending unauthenticated requests to the affected devices via Serial over TCP/IP as demonstrated by a Ud command.


ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Module component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to a incorrect access control check vulnerability in the Alternative Content component resulting in privilege escalation.


Brave Software's Brave Browser version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the \JS fingerprinting blocking\ component resulting in a malicious website being able to access the fingerprinting-associated browser functionality (that the browser intends to block).


Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.


The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control which allowed attackers to gain read-write access to system settings through the protected router configuration service tddp via the LAN and Ath0 (Wi-Fi) interfaces.


The

orbisius-child-theme-creator

plugin

before

for

WordPress

has

incorrect

access

control

for

file

modification

via

the

wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file

or

parameter.


An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11 11.4.x before 11.4.8 and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone.


Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage and also delete keys marked as private keys in external key storage. This compromises the availability of all keys configured with external key storage and may result in an economic attack in which the attacker denies legitimate users access to keys while maintaining possession of an encrypted copy (blob) of the external key store for ransom. This attack has been dubbed reverse ransomware attack and may be executed via a physical connection to the CryptoServer or remote connection if SSH or remote access to LAN CryptoServer has been compromised. The Confidentiality and Integrity of the affected keys however remain untarnished.


Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys \?scope=all\ and \?user=<username>\ query filter parameters. Enterprise editions with RBAC enabled are not affected.


An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13 11.5.x before 11.5.6 and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6).


An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13 11.5.x before 11.5.6 and 11.6.x before 11.6.1. It has Incorrect Access Control.


An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13 11.5.x before 11.5.6 and 11.6.x before 11.6.1. It has Incorrect Access Control.


Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port and forwarding requests to the IPv6 localhost port.


Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9 the setting of LDAP for authentication with STARTTLS and System Account for authorization allows an attacker to log into the server by sending any valid username with an arbitrary password.


An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An attacker can impersonate and take actions on behalf of any Mobile Application Management (MAM) enrolled device.


BMC

Remedy

Mid-Tier

and

for

BMC

Remedy

AR

System

has

Incorrect

Access

Control

in

ITAM

forms

as

demonstrated

by

TLS%3APLR-Configuration+Details/Default+Admin+View/

AST%3AARServerConnection/Default+Admin+View/

and

AR+System+Administration%3A+Server+Information/Default+Admin+View/.


Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137 Network Configuration Manager before build 123128 OpManager before build 123148 OpUtils before build 123161 and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.


An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application upon spawning a child process to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error it would cause Passenger's process manager to kill said reported arbitrary PID.


Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.


An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.


Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is \NT AUTHORITY / SYSTEM\) by sending a specially crafted request to the server.


WP ULike version 2.8.1 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2.


UnboundID

LDAP

SDK

version

from

commit

up

to

commit

where

the

issue

was

reported

and

fixed

contains

an

Incorrect

Access

Control

vulnerability

in

process

function

in

SimpleBindRequest

class

doesn't

check

for

empty

password

when

running

in

synchronous

mode.

commit

with

applied

fix

that

can

result

in

Ability

to

impersonate

any

valid

user.

This

attack

appear

to

be

exploitable

via

Providing

valid

username

and

empty

password

against

servers

that

do

not

do

additional

validation

as

per

This

vulnerability

appears

to

have

been

fixed

in

after

commit


Cobbler version Verified as present in Cobbler versions 2.6.11+ but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation data manipulation or exfiltration LDAP credential harvesting. This attack appear to be exploitable via \network connectivity\. Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.


MODX

Revolution

version

contains

a

Incorrect

Access

Control

vulnerability

in

Filtering

user

parameters

before

passing

them

into

phpthumb

class

that

can

result

in

Creating

file

with

custom

a

filename

and

content.

This

attack

appear

to

be

exploitable

via

Web

request.

This

vulnerability

appears

to

have

been

fixed

in

commit


Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+ 4.14.8+ 4.9.76+ 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) that can result in remote users reading or writing files they should not be able to via NFS. This attack appear to be exploitable via NFS server must export a filesystem with the \rootsquash\ options enabled. This vulnerability appears to have been fixed in after commit 1995266727fa.


LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.


Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.


Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for Linux and \non-enclosure\ installs - Mark 1 and Picroft unaffected. This attack appear to be exploitable remote access to the unsecured websocket server. This vulnerability appears to have been fixed in No fix currently available.


cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line \$url = $config'admin_url' . '/login.php?recoverme=' . $code;\ that can result in Administrator Password Reset Poisoning specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.


MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.


Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token or from thin air. This attack appear to be exploitable via Attacker would only need to know email address of the victim on most cases.. This vulnerability appears to have been fixed in 3.8.1.


Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.


An Incorrect Access Control issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.


An incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with firmware version 7.0.8rc3 and earlier allows an attacker with adjacent network access to read the SSH Private Key and log in to the root account.


Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them including third-party users application and payment terminals where an attacker can impersonate any user which may lead to the unauthorized disclosure modification or destruction of information.


Nacos

is

affected

by:

Incorrect

Access

Control.

An

environment

can

be

set

up

locally

to

get

the

service

details

interface.

Then

other

Nacos

service

names

can

be

accessed

through

the

service

list

interface.

Service

details

can

then

be

accessed

when

not

logged

in.


** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.


Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side which can lead to spawning a container with bind mount. Once such a container is spawned it can be leveraged to break out of the container leading to complete Docker host machine takeover.


An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8. This results in information leak via an error message caused by directly accessing the website built by UCMS.


TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.


Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform for example a user with \helpdesk\ privileges can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser.do page.


LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges intended to limit what data and services they can interact with. However no access control is enforced for WebSocket-based communication to the PM application server which will forward requests to any configured back-end server regardless of whether the user's access rights should permit this. As a result even the most low-privileged user can interact with any back-end component that has a LogRhythm agent installed.


An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e. the use of root privileges is not limited to specific programs listed in the sudoers file).


STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.


An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid document ID and token. No further authentication is required.


Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack.


An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g. name address and previous orders of any other customer).


An

incorrect

access

control

flaw

was

found

in

the

operator

openshift-service-mesh/istio-rhel8-operator

all

versions

through

This

flaw

allows

an

attacker

with

a

basic

level

of

access

to

the

cluster

to

deploy

a

custom

gateway/pod

to

any

namespace

potentially

gaining

access

to

privileged

service

account

tokens.

The

highest

threat

from

this

vulnerability

is

to

data

confidentiality

and

integrity

as

well

as

system

availability.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.


Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0 software NET_4.109.0 allows remote unauthenticated users to download the router configuration file via the /backupsettings.conf URI when any valid session is running.


Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The web service does not authenticate requests and allows attackers to send an indefinite amount of motion or doorbell events to a user's mobile application by either replaying or deliberately crafting false events.


An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.


Incorrect

access

control

in

webs

in

Ruckus

Wireless

Unleashed

through

allows

a

remote

attacker

to

leak

system

information

(that

can

be

used

for

a

jailbreak)

via

an

unauthenticated

crafted

HTTP

request.

This

affects

and

devices.


SOPlanning before 1.47 has Incorrect Access Control because certain secret key information and the related authentication algorithm is public. The key for admin is hardcoded in the installation code and there is no key for publicsp (which is a guest account).


Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE: as of 20161208 the vendor could not reproduce the issue stating \the researcher was unable to provide us with information that would allow us to confirm the behaviour and despite extensive investigation on test deployments of supported products we were unable to reproduce the behaviour as he described. The researcher has also despite additional requests for information ceased to respond to us.\


An Incorrect Access Control vulnerability exists in zzcms 8.2 which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.

incorrect access control
bypass authentication


An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a crafted executable.

incorrect access control
denial of service
dos


Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1 16.16.0 17.9.1 and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.


Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the \method\ parameter.


Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization.


The

wp-support-plus-responsive-ticket-system

plugin

before

for

WordPress

has

incorrect

authentication.


NETGEAR RN42400 devices before 6.10.2 are affected by incorrect configuration of security settings.


An incorrect configuration of the PDG Shopping Cart CGI program \shopper.cgi\ could disclose private information.

incorrect configuration of program
disclose private  information


An incorrect configuration of the Webcart CGI program could disclose private information.


An incorrect configuration of the WebStore 1.0 shopping cart CGI program \web_store.cgi\ could disclose private information.


An incorrect configuration of the Order Form 1.0 shopping cart CGI program could disclose private information.


An incorrect configuration of the SoftCart CGI program \SoftCart.exe\ could disclose private information.


An incorrect configuration of the EZMall 2000 shopping cart CGI program \mall2000.cgi\ could disclose private information.


In ImageMagick before 7.0.5-10 a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9144.


Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.


Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.


Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.


A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated local attacker to escalate their privilege level to root. The attacker must authenticate with valid user credentials. The vulnerability is due to incorrect permissions of a system executable. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level to root. Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).


A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorrect handling of SSL-encrypted traffic when Decrypt for End-User Notification is disabled in the configuration. An attacker could exploit this vulnerability by sending a SSL connection through the affected device. A successful exploit could allow the attacker to bypass a configured drop policy to block specific SSL connections. Releases 10.1.x and 10.5.x are affected.


In Apache PDFBox a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.


In Lib/tarfile.py in Python through 3.8.3 an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open because _proc_pax lacks header validation.


Microsoft OneNote 2007 SP3 2010 SP2 2013 SP1 2013 RT SP1 2016 and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNote file aka \Microsoft OneNote Information Disclosure Vulnerability.\


Moxa EDR 810 all versions 5.1 and prior allows an unauthenticated attacker to be able to retrieve some log files from the device which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user.


NVIDIA DGX servers all BMC firmware versions prior to 3.38.30 contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key which may lead to information disclosure.


In ACE2 ColorOS11 the attacker can obtain the foreground package name through permission promotion resulting in user information disclosure.


In NFC there is a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-145079309


NVIDIA GeForce NOW versions prior to 2.0.23 on Windows and macOS contains a vulnerability in the desktop application software that includes sensitive information as part of a URL which may lead to information disclosure.


Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.


Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable information disclosure via local access.


Insufficient access control in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.


Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.


Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable information disclosure via local access.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have a Security Bypass vulnerability. Successful exploitation could lead to information disclosure.


Adobe Acrobat and Reader versions 2019.008.20080 and earlier 2017.011.30105 and earlier and 2015.006.30456 and earlier have a ntlm sso hash theft vulnerability. Successful exploitation could lead to information disclosure.


Adobe Acrobat and Reader versions 2020.006.20042 and earlier 2017.011.30166 and earlier 2017.011.30166 and earlier and 2015.006.30518 and earlier have an invalid memory access vulnerability. Successful exploitation could lead to information disclosure.


The affected product is vulnerable due to an invalid pointer initialization which may lead to information disclosure.


Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs which allows authenticated team members to access this information resulting in sensitive & private information disclosure.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel information disclosure is possible in function __wlan_hdd_cfg80211_testmode since buffer hb_params is not initialized to zero.


IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031.


before

before

before

and

before

allows

Information

Disclosure

on

the

backend.


Adobe Bridge CC versions 9.0.2 have an use after free vulnerability. Successful exploitation could lead to information disclosure.


Improper buffer restrictions in the Intel(R) Unite Client for Windows* before version 4.2.13064 may allow an authenticated user to potentially enable information disclosure via local access.


Under certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager) versions - 1.0 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure.


Under certain conditions SAP Business Objects Business Intelligence Platform version 4.2 allows an attacker to access information which would otherwise be restricted leading to Information Disclosure.


Under certain conditions SAP Business One (Backup service) versions 9.3 10.0 allows an attacker with admin permissions to view SYSTEM user password in clear text leading to Information Disclosure.


Under certain conditions SAP BusinessObjects Business Intelligence platform Client Management Console (CMC) - version 430 allows an attacker to access information which would otherwise be restricted leading to Information Disclosure.


Under certain conditions SAP Business Objects Business Intelligence Platform version 4.1 4.2 dswsbobje web application allows an attacker to access information which would otherwise be restricted leading to Information Disclosure.


Adobe ColdFusion versions July 12 release (2018.0.0.310739) Update 6 and earlier and Update 14 and earlier have a directory listing vulnerability. Successful exploitation could lead to information disclosure.


Adobe ColdFusion versions July 12 release (2018.0.0.310739) Update 6 and earlier and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure.


A component of the HarmonyOS has a Use After Free vulnerability . Local attackers may exploit this vulnerability to cause Kernel Information disclosure.


Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure via local access.


Improper conditions check in the Intel(R) IPP Crypto library before version 2021.2 may allow an authenticated user to potentially enable information disclosure via local access.


Improper conditions check in BIOS firmware for 8th Generation Intel(R) Core(TM) Processors and Intel(R) Pentium(R) Silver Processor Series may allow an authenticated user to potentially enable information disclosure via local access.


HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints resulting in potential unintended information disclosure. Fixed in 1.6.3.


Clustered Data ONTAP versions 8.0 8.3.1 and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized information disclosure.


Adobe Digital Editions versions 4.5.9 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.


Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.


Adobe Digital Editions versions 4.5.7 and below have an exploitable Stack Overflow vulnerability. Successful exploitation could lead to information disclosure.


Adobe Digital Editions versions 4.5.10 and below have a buffer errors vulnerability. Successful exploitation could lead to information disclosure.


Adobe Digital Editions versions 4.5.11.187212 and below have a file enumeration (host or local network) vulnerability. Successful exploitation could lead to information disclosure.


Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure.


Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the title of Bulletin without the viewing privilege.


Information disclosure vulnerability in McAfee (now Intel Security) Cloud Analysis and Deconstructive Services (CADS) 1.0.0.3x 1.0.0.4d and earlier allows remote unauthenticated users to view add and remove users via a configuration error.


Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel.


Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.


Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest or log in to the server without specifying the domain name via a malformed userid.


Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an attacker to recover data via physical access.


Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.


Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors.


Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.


Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. A remote low privileged user could potentially exploit this vulnerability leading to unauthorized information disclosure.


Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.


GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.


Adobe Experience Manager versions 6.5 6.4 6.3 6.2 6.1 and 6.0 have an user interface injection vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.5 6.4 6.3 6.2 6.1 and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.5 6.4 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.4 6.3 6.2 6.1 and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.4 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.5 6.4 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.5 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.2 and 6.3 have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.


Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.


XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0 if exploited could lead to information disclosure. Formerly ZDI-CAN-4706.


Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.


Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer. Successful exploitation could lead to information disclosure.


Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.


Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information disclosure.


Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure.


A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.


A

flaw

was

found

in

Wildfly

A

path

traversal

vulnerability

through

the

org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource

method

could

lead

to

information

disclosure

of

arbitrary

local

files.


A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.


Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.


Windows Graphics Component Information Disclosure Vulnerability


Windows Graphics Component Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-22011 CVE-2022-26934.


Windows Graphics Component Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-22011 CVE-2022-29112.


Windows Graphics Component Information Disclosure Vulnerability.


Windows Graphics Component Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-26934 CVE-2022-29112.


A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated remote attacker to retrieve arbitrary files from the targeted device possibly resulting in information disclosure. The vulnerability is due to improper validation of user-supplied input within TFTP requests processed by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques in malicious requests sent to the TFTP service on a targeted device. An exploit could allow the attacker to retrieve arbitrary files from the targeted device resulting in the disclosure of sensitive information. This vulnerability affects Cisco IOS XR Software releases prior to Release 6.5.2 for Cisco Network Convergence System 1000 Series devices when the TFTP service is enabled.


An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions aka 'SQL Server Management Studio Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1313.


Under certain conditions SAP BusinessObjects Business Intelligence Platform (BI Workspace) versions 4.1 4.2 4.3 allows an attacker to access sensitive data such as directory structure leading to Information Disclosure.


An information vulnerability exists when Windows improperly discloses file information aka 'Windows Information Disclosure Vulnerability'.


During an OData V2/V4 request in SAP Gateway versions 750 751 752 753 the HTTP Header attributes cache-control and pragma were not properly set allowing an attacker to access restricted information resulting in Information Disclosure.


Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console) version 4.2 leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems resulting in Information Disclosure.


SAP Adaptive Server Enterprise before versions 15.7 and 16.0 under certain conditions exposes some sensitive information to the admin leading to Information Disclosure.


Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.


SAP Enable Now before version 1911 leaks information about network configuration in the server error messages leading to Information Disclosure.


Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th 7th 8th 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5 v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a privileged user to potentially enable information disclosure via local access.


Insufficient access control in protected memory subsystem for Intel(R) TXT for 6th 7th 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 Families; Intel(R) Xeon(R) E-2100 and E-2200 Processor Families with Intel(R) Processor Graphics and Intel(R) TXT may allow a privileged user to potentially enable information disclosure via local access.


An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended aka \Microsoft Exchange Information Disclosure Vulnerability.\ This affects Microsoft Exchange Server.


In some situations when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) versions 4.2 4.3 the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile resulting in Information Disclosure.


An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft SharePoint Server Information Disclosure Vulnerability'.


SAP Enable Now before version 1911 leaks information about the existence of a particular user which can be used to construct a list of users leading to a user enumeration vulnerability and Information Disclosure.


An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly aka \Microsoft Word Information Disclosure Vulnerability.\ This affects Microsoft Word Office 365 ProPlus Microsoft Office Word.


An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0549 CVE-2019-0554 CVE-2019-0569.


An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory aka 'Internet Explorer Information Disclosure Vulnerability'.


Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure via local access.


An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702 CVE-2019-0755 CVE-2019-0767 CVE-2019-0782.


Insufficient access control in protected memory subsystem for SMM for 6th 7th 8th and 9th Generation Intel(R) Core(TM) Processor families; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 families; Intel(R) Xeon(R) E-2100 and E-2200 Processor families with Intel(R) Processor Graphics may allow a privileged user to potentially enable information disclosure via local access.


An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704 CVE-2019-0821.


An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory aka \Windows Kernel Information Disclosure Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0536 CVE-2019-0549 CVE-2019-0554.


SAP Portfolio and Project Management before versions S4CORE 102 103 EPPM 100 and CPRXRPM 500_702 600_740 610_740; unintentionally allows a user to discover accounting information of the Projects in Project dashboard leading to Information Disclosure.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968 CVE-2019-1009 CVE-2019-1010 CVE-2019-1011 CVE-2019-1012 CVE-2019-1013 CVE-2019-1015 CVE-2019-1016 CVE-2019-1046 CVE-2019-1047 CVE-2019-1048 CVE-2019-1049 CVE-2019-1050.


Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65 11.11.65 11.22.65 12.0.35 and Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access.


An information disclosure vulnerability exists when the win32k component improperly provides kernel information aka 'Win32k Information Disclosure Vulnerability'.


An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability an authenticated attacker could run a specially crafted application aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0621 CVE-2019-0661.


An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602 CVE-2019-0615 CVE-2019-0616 CVE-2019-0660 CVE-2019-0664.


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112713720


In extract3GPPGlobalDescriptions of TextDescriptions.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-124781927.


Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in MSM8909W MSM8996AU QCS605 Qualcomm 215 SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 636 SD 665 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820 SD 820A SD 835 SD 845 / SD 850 SD 855 SD 8CX SDA660 SDM439 SDM630 SDM660 Snapdragon_High_Med_2016 SXR1130


In DeepCopy of btif_av.cc there is a possible out of bounds read due to improper casting. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-140768453


In various functions of Parcel.cpp there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-130161842.


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112611181


In l2cu_send_peer_config_rej of l2c_utils.cc there is a possible out-of-bound read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-119870451.


In poisson_distribution of random there is an out of bounds read. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139690488


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112611363


In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117661478


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112709994


In HIDL safe_union and other C++ structs/unions being sent to application processes there are uninitialized fields. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-131356202


In processPhonebookAccess of CachedBluetoothDevice.java there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact list with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-138529441


In Mfc_Transceive of phNxpExtns_MifareStd.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-125900276.


In heap of spaces.h there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure when processing a proxy auto config file with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android ID: A-117555811


Information

disclosure

due

to

lack

of

address

range

check

done

on

the

SysDBG

buffers

in

SDI

code.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117610049


In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-113035224


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-114746174


In generateServicesMap of RegisteredServicesCache.java there is a possible account protection bypass due to a caching optimization. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-136261465


In ScreenRotationAnimation of ScreenRotationAnimation.java there is a possible capture of a secure screen due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-69703445


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116474108


In nfc_ncif_decode_rf_params of nfc_ncif.cc there is a possible out of bounds read due to an integer underflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-124940143


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118494320


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112768568


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112859714


In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-120506143


In libAACdec there is a possible out of bounds read. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: Android Versions: Android-10 Android ID: A-136089102


In ComposeActivityEmailExternal of ComposeActivityEmailExternal.java in Android 7.1.1 7.1.2 8.0 8.1 and 9 there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure.


In rw_i93_process_ext_sys_info of rw_i93.cc there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-122316913.


Unauthorized

access

from

GPU

subsystem

to

HLOS

or

other

non

secure

subsystem

memory

can

lead

to

information

disclosure

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118138797


In device_class_to_int of device_class.cc there is a possible out of bounds read due to improper casting. This could lead to local information disclosure in the Bluetooth server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-140152619


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118145923


In multiple functions of key_store_service.cpp there is a possible Information Disclosure due to improper locking. This could lead to local information disclosure of protected data with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-131622568.


In uvc_parse_standard_control of uvc_driver.c there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115509210


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112552816


In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118615501


In StatsService there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-143895055


In Download Provider there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269143


In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-113035086


In Download Provider there is a possible SQL injection vulnerability. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135270103


In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112705708


In ippSetValueTag of ipp.c in Android 8.0 8.1 and 9 there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure from the printer service with no additional execution privileges needed. User interaction is not needed for exploitation.


In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118492282


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118766492


In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112856493


In llcp_dlc_proc_rr_rnr_pdu of llcp_dlc.cc there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-116788646


In nfcManager_routeAid and nfcManager_unrouteAid of NativeNfcManager.cpp there is possible memory reuse due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141170038