CVE-2018-1106

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system...

CVE-2018-1106

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system...

Override Access Vulnerability in Skyrunner Vulnerability Scanning and Management System v3.3.0

TopScanner, abbreviated as TopScanner, is a vulnerability scanning and management assessment product launched by Beijing Tianrongxin based on years of experience in network security product development, including application detection, vulnerability scanning, vulnerability identification, risk...

Wordpress Relevanssi 4.0.4 Plugin - Reflected Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Relevanssi Wordpress Search Plugin Reflected Cross Site Scripting XSS Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://www.relevanssi.com Software Link:...

PT-2018-6741

Name of the Vulnerable Software and Affected Versions: Exponent CMS versions prior to 2.4.1 Patch 6 Description: The issue allows certain admin users to elevate their privileges. Recommendations: For versions prior to 2.4.1 Patch 6, update to version 2.4.1 Patch 6 or later to resolve the issue...

CVE-2017-18213: Undefined Security Weakness

In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...

Hoosk Cross-Site Request Forgery Vulnerability

Hoosk is a lightweight user-centered content management system CMS. The system has built-in Codelgniter for creating responsive websites. A cross-site request forgery vulnerability exists in Hoosk version 1.7.0. A remote attacker can exploit the vulnerability to create an account with the help of...

Cross site request forgery (csrf)

CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation...

PT-2018-18168

Name of the Vulnerable Software and Affected Versions Hoosk version 1.7.0 Description A CSRF issue exists, allowing for account creation via the "/admin/users/new/add" API endpoint. Recommendations For Hoosk version 1.7.0, as a temporary workaround, consider restricting access to the...

CVE-2018-7590: Cross-Site Request Forgery (CSRF)

CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation...

PT-2018-17803

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description A critical issue was discovered where the User Permissions page, also known as Admin/Users, is affected by a Cross Site Request Forgery flaw. This allows a malicious user to trick another user into unknowingl...

Debian DLA-1252-1 : couchdb security update

CVE-2017-12635 Prevent non-admin users to give themselves admin privileges. CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-5+deb7u1. We recommend that y...

UBUNTU-CVE-2018-5690

Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...

How to get the traces for Citrix Receiver for Windows (Store) 4.10

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. This article describes how to get traces for Citrix Receiver for Windows Store 4.10 edition...

WordPress Download Manager 2.9.60 Cross Site Request Forgery

Exploit Title: WordPress Download Manager CSRF Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://www.wpdownloadmanager.com/ Software Link: https://wordpress.org/plugins/download-manager Version: 2.9.60 Tested on:...

WordPress Download Manager 2.9.60 Plugin - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Download Manager CSRF Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://www.wpdownloadmanager.com/ Software Link: https://wordpress.org/plugins/download-manager...

WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery

WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery Exploit Title: WordPress Download Manager CSRF Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://www.wpdownloadmanager.com/ Software Lin...

CVE-2017-5254

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism...

Design/Logic Flaw

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism...

CVE-2017-5254

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism...