117 matches found
PT-2019-19995
Name of the Vulnerable Software and Affected Versions express-cart versions prior to 1.1.6 Description The issue allows normal users to escalate their privileges, enabling them to add new administrator users. Recommendations Update to version 1.1.6 or later...
Ivan Cordoba Generic Content Management System Cross-Site Scripting Vulnerability (CNVD-2019-16169)
Ivan Cordoba Generic Content Management System CMS is a content management system CMS based on MySQL and PHP. A cross-site scripting vulnerability exists in the Administrator/users.php file in Ivan Cordoba Generic CMS on 2018-04-28 and earlier versions, which can be exploited by a remote attacker...
CVE-2018-20590
Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...
Privilege Escalation
Overview Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users. Recommendation Update to version 1.1.6 or later. References - HackerOne Report - Node.js...
SSRF/XSPA in ImporterSetupPage
h2. A security bug has been found in Jira Server. Administrator users can test local IP addresses/ports and determine whether they're open or closed. To reproduce: h2. Initial setup - Download https://www.atlassian.com/software/jira/download, install, and start up Jira Software Server. Note: I...
CVE-2018-12603
Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...
CVE-2018-12603
Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...
PT-2018-11284
Name of the Vulnerable Software and Affected Versions LFCMS version 3.7.0 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of users for requests that add administrator users via the s parameter. Recommendations For LFCMS version...
CVE-2015-7257
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...
http-vuln-cve2014-3704 NSE Script
Exploits CVE-2014-3704 also known as 'Drupageddon' in Drupal. Versions 7.32 of Drupal core are known to be affected. Vulnerability allows remote attackers to conduct SQL injection attacks via an array containing crafted keys. The script injects new Drupal administrator user via login form and the...
CVE-2015-3235
Foreman before 1.9.0 allows remote authenticated users with the editusers permission to edit administrator users and change their passwords via unspecified vectors...
Poster 2.0 Unauthorized Privileged User Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8426/info A vulnerability has been reported for Poster.version:two. The problem occurs due to the application failing to lock the 'setup' variable after initialization. As a result, an attacker may access this variable to...
Magnolia CMS Access Bypass Vulnerability
This host is running Magnolia CMS and is prone to access bypass vulnerability. OpenVAS Vulnerability Test $Id: gbmagnoliaaccessbypassvuln.nasl 6115 2017-05-12 09:03:25Z teissa $ Magnolia CMS Access Bypass Vulnerability Authors: Arun Kallavi Copyright: Copyright c 2013 Greenbone Networks GmbH,...
Debian DSA-1954-1 : cacti - insufficient input sanitising
Several vulnerabilities have been found in cacti, a frontend to rrdtool for monitoring systems and services. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3112, CVE-2007-3113 It was discovered that cacti is prone to a denial of service via the...
New cacti packages fix insufficient input sanitising
No description provided by source. - ------------------------------------------------------------------------ Debian Security Advisory DSA-1954-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 16, 2009 http://www.debian.org/security/faq -...
WinPcap 4.0 NPF.SYS Privilege Elevation Vulnerability PoC Exploit
No description provided by source. / WinPcap NPF.SYS Privilege Elevation Vulnerability PoC exploit ------------------------------------------------------------- Affected software: WinPcap versions affected Confirmed - WinPcap 4.0 and previous WinPcap fixed version stable : WinPcap 4.0.1 ...
