PrestaShop Authorization Issues Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. PrestaShop suffers from an authorization issue vulnerability that originates from an...

CVE-2020-4074

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...

Authentication flaw

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...

CVE-2020-4074

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...

CVE-2020-4074: Improper Authentication

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...

PT-2020-17863 · Prestashop · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions 1.5.0.0 through 1.7.6.6 PrestaShop versions 1.5.0.0 through 1.7.7.6 is not used because 1.7.6.6 is the fixed version mentioned in the NVD source which has higher priority than Telegram. Description: The authentication syst...

CVE-2020-3229

A vulnerability in Role Based Access Control RBAC functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administrati...

Siemens SiNVR 3 SQL Injection Vulnerability

SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 has a SQL injection vulnerability in the XML-based communication protocol by default, which can be exploited by remote attackers to read or modify the...

PT-2020-2444 · Unknown · Control Center Server

Name of the Vulnerable Software and Affected Versions: Control Center Server versions prior to V1.5.0 Description: The issue is related to a lack of protection against SQL query structure exploitation. This can be exploited by a remote attacker to read or modify the central control server databas...

DEBIAN-CVE-2019-10784

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to vis...

Cross-site Request Forgery (CSRF)

Overview phppgadmin/phppgadmin is a web-based administration tool for PostgreSQL. It is perfect for PostgreSQL DBAs, newbies, and hosting services. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. Multiple areas within the application allows sensitive actions t...

Multiple vulnerabilities in WordPress Plugin "wpDataTables Lite"

Overview WordPress Plugin "wpDataTables Lite" provided by TMS-Plugins contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6011 SQL Injection CWE-89 - CVE-2019-6012 Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to the developer and...

CVE-2019-6646

On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges...

SoftNAS Cloud Command Execution Vulnerability

SoftNAS Cloud is a software-defined NAS file management system from US-based SoftNAS. The system is primarily used to provide enterprise-class NAS functionality, including encryption, snapshots and automatic failover. A security vulnerability exists in SoftNAS Cloud versions 4.2.0 and 4.2.1. A...

CVE-2018-0626

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter...

Cisco Small Business Auth Bypass Privilege Escalation

The vulnerability of Cisco Small Business network device software’s microprogramming lies in the use of pre-installed credentials. This vulnerability could allow a malicious actor to bypass authentication procedures and execute arbitrary commands with administrator privileges...

CVE-2018-17933

VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...

PT-2018-14282

Name of the Vulnerable Software and Affected Versions VGo Robot versions 3.0.3.52164 through 3.0.3.53662 VGo Robot versions prior to 3.0.3.52164 Description The issue allows user accounts to execute commands outside their privileges, potentially within the scope of an admin account. If an attacke...

OpenVPN Cross-Site Scripting Vulnerability

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

CVE-2017-2336

A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker...