CVE-2020-25629

CVE-2020-25629 concerns Moodle: in versions affected (3.9.x up to 3.9.1; 3.8 up to 3.8.4; 3.7 up to 3.7.7; 3.5 to 3.5.13 and earlier unsupported), users with the Log in as capability in a course context may gain access to some site administration capabilities by logging in as a System manager . T...

CVE-2020-25629

A vulnerability was found in Moodle where users with "Log in as" capability in a course context typically, course managers may gain access to some site administration capabilities by "logging in as" a System manager. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect for Workstations Central Administration Console

Summary IBM Spectrum Protect for Workstations Central Administration Console requires the dependent product IBM WebSphere Application Server Liberty. Information about security vulnerabilities affecting IBM WebSphere Application Server Liberty has been published in security bulletins. Vulnerabili...

Cross site request forgery (csrf)

Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration...

CVE-2020-13620

CVE-2020-13620 describes a cross-site request forgery (CSRF) vulnerability in Fastweb FASTGate GPON FGA2130FWB devices up to 2020-05-26, allowing an attacker to perform administrative actions by abusing the router’s web panel. Affected component is the router administration web interface; root ca...

CVE-2020-13620

Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration...

U.S. General Services Administration: CRLF INJECTION

Vulnerable url - https://www.epay.fas.gsa.gov/%0D%0ASet-Cookie:crlfinjection=crlfinjection Impact an attacker can set new header...

Trend Micro Worry-Free Business Security Path Traversal Arbitrary Remote File Deletion Vulnerability

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security and e-mail protection. A path traversal arbitrary remote file deletion vulnerability exists in Trend Mic...

Oracle WebLogic Server Administration Console Handle Remote Code Execution Exploit

This Metasploit module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against...

Oracle WebLogic Server Administration Console Handle Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle WebLogic Server Administration Console Handle RCE', 'Description' = %q This module exploits a path traversal and a Java class instantiatio...

Trend Micro Worry-Free Business Security 路径遍历漏洞

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security and e-mail protection. A path traversal arbitrary remote file deletion vulnerability exists in Trend Mic...

CVE-2020-13350

CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are =13.5.0, =13.4.0, 13.4.5,13.3.9...

Samba <= 2.0.7 Multiple Vulnerabilities

The Samba Web Administration Tool SWAT shipped in Samba is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-late...

PT-2020-13491 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.3.0 through 13.3.8 GitLab CE/EE versions 13.4.0 through 13.4.4 GitLab CE/EE versions 13.5.0 through 13.5.1 Description: A CSRF issue in the runner administration page of GitLab CE/EE allows an attacker to target GitLa...

The vulnerability of the Work Provider Administration component of the application, which is responsible for accessing, organizing, and interacting with various types of Oracle Universal Work Queue tasks, allows a malicious individual to gain unauthorized access to protected information, execute arbitrary code, or cause service failures.

The vulnerability of the Work Provider Administration component of the application, which is responsible for accessing, organizing, and interacting with various types of Oracle Universal Work Queue tasks, is related to insufficient validation of input data. Exploiting this vulnerability could all...

Trojanized Security Software Hits South Korea Users in Supply-Chain Attack

Cybersecurity researchers took the wraps off a novel supply chain attack in South Korea that abuses legitimate security software and stolen digital certificates to distribute remote administration tools RATs on target systems. Attributing the operation to the Lazarus Group, also known as Hidden...

Trojanized Security Software Hits South Korea Users in Supply-Chain Attack

Cybersecurity researchers took the wraps off a novel supply chain attack in South Korea that abuses legitimate security software and stolen digital certificates to distribute remote administration tools RATs on target systems. Attributing the operation to the Lazarus Group, also known as Hidden...

The vulnerability of the Analytics Web Administration component of the Oracle Business Intelligence Enterprise Edition software allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Analytics Web Administration component of the Oracle Business Intelligence Enterprise Edition relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to modify, add, or delete data using the HTTP protocol...

CVE-2020-4685

A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos...

Security Bulletin: CSV Injection Security vulnerability in ACCE in FileNet Content Manager

Summary Administration Console for Content Platform Engine ACCE CSV Injection Security vulnerability exists in FileNet Content Manager Vulnerability Details CVEID: CVE-2020-4759 DESCRIPTION: IBM FileNet Content Manager is potentially vulnerable to CVS Injection. A remote attacker could execute...