1924 matches found
CVE-2019-17118
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
PT-2019-14956
Name of the Vulnerable Software and Affected Versions WiKID 2FA Enterprise Server versions through 4.2.0-b2053 Description A CSRF issue allows a remote attacker to trick an authenticated user into performing unintended actions, including creating or deleting admin users, creating or deleting...
CVE-2019-17575
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
LimeSurvey < 3.17.14 Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Code injection
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
Code injection
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
Design/Logic Flaw
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions...
CVE-2019-16181
CVE-2019-16181 affects LimeSurvey prior to 3.17.14, where admin users can mark other users’ notifications as read. The Red Hat/NVD/OpenVAS records corroborate the same issue across multiple feeds. The vulnerability is documented with a low CVSS 3.1 base score (2.7) in NVD, indicating limited impa...
CVE-2019-16183
LimeSurvey vulnerability CVE-2019-16183 affects LimeSurvey prior to 3.17.14. The issue is an improper permissions check that allows admin users to run an integrity check without proper privileges. Affected product: LimeSurvey (PHP-based web app); vulnerable component: integrity check flow; root c...
CVE-2019-16185
In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions...
PT-2019-14565
Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description The issue allows admin users to view, update, or delete reserved menu entries without having the proper permissions. Recommendations For versions prior to 3.17.14, update to version 3.17.14 or...
PT-2019-14561
Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description The issue allows admin users to mark other users' notifications as read. Recommendations For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue...
CVE-2019-16181: Undefined Security Weakness
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
CVE-2019-16186: Incorrect Default Permissions
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
CVE-2019-16183: Incorrect Default Permissions
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions...
CVE-2019-16185: Incorrect Default Permissions
In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
