CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

PT-2018-10575

Name of the Vulnerable Software and Affected Versions EasyService Billing version 1.0 Description A CSRF issue was found on the "system-settings-user-new2.php" page, specifically the User Add/System Settings Page, allowing a user to be added with the Admin role. Recommendations For EasyService...

CVE-2018-11445: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

CVE-2017-1000156

Concrete details found: Mahara versions 15.04 before 15.04.9, 15.10 before 15.10.5, and 16.04 before 16.04.3 are vulnerable to an issue where a user in a group can edit the group’s configuration page even without admin privileges. The root cause is a permission/role check failing for group config...

Default credentials

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...

CVE-2016-6815

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...

CVE-2016-6815

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...

PT-2017-9027

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.6.2 Description The issue concerns users with the keyadmin role being able to change passwords for users with the admin role, which they should not be allowed to do. Recommendations For versions prior to 0.6.2...

CVE-2016-6815: Undefined Security Weakness

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...

X-Pack Alerting and Kibana 5.6.1 security update

X-Pack alerting privileged user multiple issues An error was found in the permission model used by X-Pack alerting whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges. Affected Versions: 5.0.0 to 5.6.0 Solutions and Mitigations...

HelpDEZK 1.1.1 - Cross-Site Request Forgery Code Execution

HelpDEZK 1.1.1 - Cross-Site Request Forgery Code Execution Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software...

Moderate: Red Hat Bug Fix Advisory: Satellite 6.2.2 bug fix update

Updated Satellite 6.2 packages that fix several bugs are now available. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

F5 BIG-IP Application Security Manager (ASM) XSS

Edit: Corrected the date in the timeline from 01/12/14 to 01/12/15. Details ======= Product: F5 BIG-IP Application Security Manager ASM Vulnerability: Cross Site Scripting Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Confirmed 11.4.0, 11.4.1. Likely 11.4.x-11.5.x...

WordPress Pods 2.4.3 CSRF / Cross Site Scripting

Vulnerability title: Wordpress plugin Pods alert'xss' target="http://localhost"; for i=0; i'; CSRF 2 delete pods plugin data: CSRF 3 deactivate pods and delete data: CSRF 4 enable "roles and capab...

Omeka 2.2.1 - Remote Code Execution

Omeka 2.2.1 - Remote Code Execution !/usr/bin/env python Omeka 2.2.1 Remote Code Execution Exploit Vendor: Omeka Team CHNM GMU Product web page: http://www.omeka.org Affected version: 2.2.1 and 2.2 Summary: Omeka is a free, flexible, and open source web-publishing platform for the display of...

Splunk 5.0 Custom App Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

Microweber CMS 0.93 - CSRF Vulnerability

No description provided by source. Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC where attacker can u...