9091 matches found
PT-2022-6694 · Schneider Electric · Ecostruxure Ev Charging Expert
Name of the Vulnerable Software and Affected Versions: EcoStruxure EV Charging Expert versions prior to V4.0.0.13 Description: A vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within...
PT-2022-16706 · Unknown · Nats Server +1
Name of the Vulnerable Software and Affected Versions: NATS Server versions prior to 2.7.2 NATS Streaming Server versions prior to 0.24.1 Description: The issue is related to Incorrect Access Control in NATS nats-server, where any authenticated user can obtain the privileges of the System account...
Nats-Server 访问控制错误漏洞
Nats-Server is a high-performance server for Nats.io, cloud and edge native messaging systems. An access control error vulnerability exists in nats-server, which arises from the product allowing any authenticated user to gain privileges on the System account by abusing the "dynamically provisione...
GHSA-CH68-7CF4-35VR Limited ability to spoof SAML authentication with missing audience verification in Fleet
Impact This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, and the user signs into the malicious SP via SAML SSO...
Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.10 on OpenJDK for OpenShift image security update
A new image is available for Red Hat Single Sign-On 7.4.10 on OpenJDK, running on OpenShift Container Platform 3.10 and 3.11, and 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...
The vulnerability of Yokogawa’s software products, related to the use of pre-installed account data, allows a hacker to gain full access to the system.
The vulnerability of Yokogawa software products is related to the use of pre-installed account data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the system...
StarWind SAN & NAS 授权问题漏洞
StarWind SAN & NAS is a standalone hypervisor server or group of servers for StarWind.A security vulnerability exists in StarWind SAN & NAS that could be exploited by an attacker to reset the passwords of other users...
CVE-2021-29394
Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...
Code injection
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...
CVE-2021-43145
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...
Zammad 安全漏洞
Zammad is a suite of ticket management software from the German company Zammad. version 5.0.1 of Zammad contains a security vulnerability that stems from an LDAP configuration with privilege issues and is vulnerable to an attack with unauthorized access to existing user accounts. No details of th...
Domain Escalation – Machine Accounts
The pass the hash technique is not new and it was usually used for lateral movement on the network in scenarios where the administrator password… Continue reading - Domain Escalation - Machine Accounts...
Domain Escalation – Machine Accounts
The pass the hash technique is not new and it was usually used for lateral movement on the network in scenarios where the administrator password… Continue reading - Domain Escalation - Machine Accounts...
CVE-2022-21659
Removed by vendor...
CVE-2022-21659 Observable Response Discrepancy in Flask-AppBuilder
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...
CVE-2022-22561
Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts...
CVE-2022-23887
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete...
Cross site request forgery (csrf)
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete...