Schneider Electric MGE UPS and MGE STS 66074 MGE Network Management Card Transverse Sensitive Information Vulnerability (CNVD-2018-11132)

The Schneider Electric MGE UPS and MGE STS are both products of the French company Schneider Electric.The Schneider Electric MGE UPS is an uninterruptible power supply unit.The MGE STS is a static toggle switch.66074 MGE Network Management Card Transverse is one of the network management cards...

TP-Link EAP Controller and Omada Controller Elevation of Privilege Vulnerability

TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A security vulnerability exists in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows, which originates from the program's...

First things first: Envisioning your security deployment

This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...

Design/Logic Flaw

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before version 1.6.4 is vulnerable to an admin authentication bypass that allows an attacker to gain admin access. The issue is documented across multiple sources (NVD, Nuclei template, SUSE, CNVD, OSV, etc.) with the root cause described as an admin-privilege bypass affecting Ether...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

PT-2018-19069

Name of the Vulnerable Software and Affected Versions Etherpad Lite versions prior to 1.6.4 Description The issue allows for exploitation to gain admin access. Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue...

CVE-2018-9845: Improper Handling of Case Sensitivity

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-10519

CMS Made Simple CMSMS 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE$this-loginkey to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because o...

Stellar.org: brute force attack allowed on admin page https://www.stellar.org/wp-admin/

hi security team -due to your bug bounty program , i found basic authentication method -by doing many trials the server will response and will not block the logging process - the attack can be automated by burp intruder till getting access to admin page - in second screen the request is intercept...

VK.com: Часть админки доступна для всех пользователей

Раскрытие старого админ. интерфейса...

CVE-2017-2871

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CMS Made Simple Elevation of Privilege Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS 2.2.6 and...