523 matches found
CVE-2022-41496
iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery SSRF via the url parameter at admincp.php...
iCMS 代码问题漏洞
iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. A security vulnerability exists in iCMS version v7.0.16, which originates from a server-side request forgery SSRF contained in the url parameter via admincp.php...
CVE-2022-37968
Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, becaus...
CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...
ONLY ADMIN IS ABLE TO CHANGE THE VOTING PARAMETERS
Lines of code Vulnerability details Impact In both the NounsDAOLogicV1 and NounsDAOLogicV2 contracts, only admin is able to change the voting parameters which includes : VotingDelay VotingPeriod ProposalThresholdBPS MinQuorumVotesBPS MaxQuorumVotesBPS QuorumCoefficient This will ma...
the customers can’t just trust the admin
Lines of code Vulnerability details The users can’t just trust the admin eve with multi-sig. So the admin can on anytime change the lenderFee to 100% just by calling replaceLenderFee Recommended Mitigation Steps Add a maximum value for lenderFee to ensure that the admin can’t update the lenderFee...
Who Has Control: The SaaS App Admin Paradox
Imagine this: a company-wide lockout to the company CRM, like Salesforce, because the organization's external admin attempts to disable MFA for themselves. They don't think to consult with the security team and don't consider the security implications, only the ease which they need for their team...
Novel Malware Hijacks Facebook Business Accounts
A new malware is hijacking high-profile Meta Facebook Business and advertising platform accounts through a phishing campaign that targets LinkedIn accounts. The malware, dubbed Ducktail, uses browser cookies from authenticated user sessions to take over accounts and steal data, researchers said...
Cross site request forgery (csrf)
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks...
[M-04] Admin can lose control on the contract
Lines of code Vulnerability details Proof of Concept The setAdmin function is too loose, if no one have access to the address passed in this function, the whole project is stuck - cannot withdraw funds or fees, cannot create new markets, etc. Recommended Mitigation Steps Change setAdmin in favour...
Admin can set arbitrarily high WETH_TRANSFER_GAS_UNITS which is a fee
Lines of code Vulnerability details Impact Users can lose their fund by attack from the admins Poc In the function updateWethTranferGasInfinityExchange.sol there is no limit for setting WETHTRANSFERGASUNITS . As this is a kind of fee paid by from the buyers to the contract By definition of the...
CVE-2022-30863
FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...
CVE-2022-30860
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel...
CVE-2022-30860
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel...
CVE-2022-30863
FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...
Cross site scripting
FUDForum 3.1.2 is vulnerable to Cross Site Scripting XSS via pagetitle param in Page Manager in the Admin Control Panel...
Remote code execution
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel...
CVE-2022-30863
CVE-2022-30863 affects FUDForum 3.1.2 and is documented as a Cross-Site Scripting (XSS) vulnerability via the page_title parameter in the Page Manager of the Admin Control Panel. The provided connected sources consistently describe the issue but do not specify technical details beyond the vulnera...
