PT-2019-11464

Name of the Vulnerable Software and Affected Versions: DomainMOD version 4.10.0 Description: The issue allows for Cross Site Request Forgery CSRF attacks, which can lead to the addition of an administrator account. The vulnerable component is the admin/users/add.php page. The attack can occur aft...

PT-2019-11465

Name of the Vulnerable Software and Affected Versions: DomainMOD version 4.10.0 Description: The issue allows for a Cross Site Request Forgery CSRF attack, which can change a read-only user to an admin. The component affected is the "admin/users/edit.php?uid=2" endpoint. The attack can occur afte...

CVE-2019-1010096: Cross-Site Request Forgery (CSRF)

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page...

CVE-2019-1010094: Cross-Site Request Forgery (CSRF)

domainmod v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector...

CVE-2019-1010095: Cross-Site Request Forgery (CSRF)

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html page...

PT-2019-16907 · Ibm · Ibm Multicloud Manager

Name of the Vulnerable Software and Affected Versions: IBM Multicloud Manager versions 3.1.0 through 3.1.2 Description: A local attacker with admin privileges could obtain highly sensitive information upon deployment. Recommendations: For versions 3.1.0 through 3.1.2, at the moment, there is no...

FaceSentry Access Control System 6.4.8 - Cross-Site Request Forgery

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN is a...

CVE-2019-12890

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insertone call...

Authentication flaw

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insertone call...

CVE-2019-12890

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insertone call...

PT-2019-13002

Name of the Vulnerable Software and Affected Versions RedwoodHQ version 2.5.5 Description The issue allows remote attackers to create admin users without requiring any authentication for database operations. This can be achieved via a con.automationframework users insert one call. Recommendations...

CVE-2019-12890: Missing Authentication for Critical Function

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insertone call...

CVE-2019-12816

Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name...

CVE-2019-12816

CVE-2019-12816 affects ZNC (before 1.7.4-rc1). Vulnerability in Modules.cpp allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name. Impacted component: ZNC IRC bouncer; condition requires authentication but not admin p...

CVE-2019-12764

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

KACE System Management Appliance (SMA) 9.0.270 - Multiple Vulnerabilities

KACE System Management Appliance SMA 9.0.270 - Multiple Vulnerabilities Exploit Title: Dell Kace Appliance Multiple Vulnerabilities Date: 12/04/2018 Exploit Author: SlidingWindow, Twitter: @kapilkhot Vendor Homepage: https://www.quest.com/products/kace-systems-management-appliance/ Affected...

CVE-2019-11393

An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...

PT-2019-12279

Name of the Vulnerable Software and Affected Versions M/Monit versions prior to 3.7.3 Description An issue was discovered in the "/admin/users/update" API endpoint. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the adm...

CVE-2017-17544

A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to superadmin via restoring modified configurations...

CVE-2017-17544

A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to superadmin via restoring modified configurations...