1839 matches found
CVE-2020-8500
In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality...
Unable to add Store to Workspace App on Windows - Your account cannot be added using this server address
This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information Unable to add Store to Workspace App on Windows and Mac Client machines...
MTN Group: Unsafe cors sharing of admin users
hello, the following endpoint https://lonestarcell.com/wp-json/wp/v2/users/ has an unsafe sharing of sensitive information of admin usernames check poc script below : html CORS PoC Exploit function cors var xhr = new XMLHttpRequest; xhr.onreadystatechange = function if this.readyState == 4 &&...
CVE-2019-15011
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
CVE-2019-15011
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
CVE-2019-15011: Incorrect Default Permissions
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
Cross site scripting
When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...
Protect
A privilege escalation vulnerability in FortiOS may allow admin users to elevate their profile to superadmin, via restoring modified configurations...
CVE-2019-3865
A stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name...
CVE-2019-17118
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
CVE-2019-17118
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
CVE-2019-17575
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
LimeSurvey < 3.17.14 Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Code injection
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
Code injection
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
Design/Logic Flaw
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions...
CVE-2019-16181
CVE-2019-16181 affects LimeSurvey prior to 3.17.14, where admin users can mark other users’ notifications as read. The Red Hat/NVD/OpenVAS records corroborate the same issue across multiple feeds. The vulnerability is documented with a low CVSS 3.1 base score (2.7) in NVD, indicating limited impa...
CVE-2019-16183
LimeSurvey vulnerability CVE-2019-16183 affects LimeSurvey prior to 3.17.14. The issue is an improper permissions check that allows admin users to run an integrity check without proper privileges. Affected product: LimeSurvey (PHP-based web app); vulnerable component: integrity check flow; root c...