CVE-2018-17184

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admi...

GHSA-V7MF-QGXF-QMVF Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies

Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...

Django -- password hash disclosure

Django release notes: CVE-2018-16984: Password hash disclosure to "view only" admin users If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view but not change permission to the user model were...

CVE-2018-14808

Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected products...

CVE-2018-14808

Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected products...

NUUO NVR < 3.9.1 Backdoor Activated - Active Check

The Backdoor in NUUO NVR is active. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nuuo:nuuo"; if description...

CVE-2018-17131

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...

CVE-2018-17133

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting...

CVE-2018-17132

admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...

CVE-2018-17134

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfgauthor field in conjunction with a crafted cfgwebpath field...

Code injection

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting...

Design/Logic Flaw

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...

Code injection

admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...

Design/Logic Flaw

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfgauthor field in conjunction with a crafted cfgwebpath field...

CVE-2018-17131

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...

CVE-2018-17132

admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...

CVE-2018-17134

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfgauthor field in conjunction with a crafted cfgwebpath field...

CVE-2018-17133

CVE-2018-17133 affects PHPMyWind 5.5, where admin/web_config.php allows an Admin user to execute arbitrary code via the rewrite url setting. Root cause is improper handling of URL rewrite configuration leading to code execution with admin privileges. Impact is arbitrary code execution; CVSS notes...

CVE-2018-17132

CVE-2018-17132 affects PHPMyWind 5.5: admin/goods_update.php can be abused by Admin users to execute arbitrary code via the attrvalue[] array parameter. The vulnerability arises from how the parameter is handled, enabling code execution with admin privileges. The connected documents confirm the a...

CVE-2018-17132: Improper Control of Generation of Code

admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...