1605 matches found
CVE-2019-12816
CVE-2019-12816 affects ZNC (before 1.7.4-rc1). Vulnerability in Modules.cpp allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name. Impacted component: ZNC IRC bouncer; condition requires authentication but not admin p...
CVE-2019-12764
An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...
KACE System Management Appliance (SMA) 9.0.270 - Multiple Vulnerabilities
KACE System Management Appliance SMA 9.0.270 - Multiple Vulnerabilities Exploit Title: Dell Kace Appliance Multiple Vulnerabilities Date: 12/04/2018 Exploit Author: SlidingWindow, Twitter: @kapilkhot Vendor Homepage: https://www.quest.com/products/kace-systems-management-appliance/ Affected...
CVE-2019-11393
An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...
CVE-2017-17544
A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to superadmin via restoring modified configurations...
CVE-2017-17544
A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to superadmin via restoring modified configurations...
How To Configure RADIUS and TACACS servers for read-only and admin users in SD-WAN
...
Workspace App for Windows - Your apps are not available at this time - Issue when installing Citrix Receiver in not elevated/per-user install mode
This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. The Organization is deploying Workspace App for Windows for the users. Some of these users have...
CVE-2019-7566
CSZ CMS 1.1.8 has CSRF via admin/users/new/add...
Cross site request forgery (csrf)
CSZ CMS 1.1.8 has CSRF via admin/users/new/add...
CVE-2019-7566
CSZ CMS 1.1.8 contains a CSRF vulnerability in the admin/users/new/add flow. Root cause: improper CSRF protection in the user-creation endpoint. Impact per CVSS3 is HIGH (C/H, I/H, A/H) with NETWORK attack vector, LOW attack complexity, NONE privileges, UI required; authenticated user interaction...
Authentication Bypass
packagekit is vulnerable to authentication bypass attacks. The vulnerability exists as an authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install...
Denial Of Service (DoS)
jboss eap is vulnerable to denial of service. It was found that JBoss EAP did not properly authorize a user performing a shut down. A remote user with the Monitor, Deployer, or Auditor role could use this flaw to shut down the EAP server, which is an action restricted to admin users...
Design/Logic Flaw
Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...
CVE-2018-17188
Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...
phpipam cross-site scripting vulnerability (CNVD-2019-43862)
phpIPAM is a set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in the /app/admin/users/print-user.php file in PHPipam 1.3.2 and earlier versions. An attacker can exploit this vulnerability to execute code in a user's browser...
Cannot start apps. Please run Reset Receiver to resolve a lockdown conflict for LegacyLocalUserNameAndPassword (error 2320).
This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Getting following error message while trying to launch application...
Nagios XI Cross-Site Scripting Vulnerability (CNVD-2018-23144)
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in Nagios XI 5.5.6. A remote authenticated attacker can exploit this vulnerability to...
