Authentication Bypass by Spoofing in express-cart

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

Citrix Workspace App Launcher is unable to launch applications automatically with Safari 12

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Citrix Workspace App Launcher is not able to launch applications automatically with Safari browser...

CSRF vulnerability and missing permission checks in Kanboard Plugin allowed server-side request forgery

Kanboard Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to submit a GET request to an attacker-specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF...

XSS vulnerability via user description in Blue Ocean

Blue Ocean did not properly escape HTML/JavaScript content set on the current user's description field, resulting in a cross-site scripting vulnerability exploitable by administrators and other people accessing Jenkins with the same user account. Blue Ocean now properly escapes HTML/JavaScript...

CVE-2019-3584

Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 18.11.31.62 allows authenticated administrator users -- administrators to Remove MVision Endpoint via unspecified vectors...

CVE-2019-3584 Exploitation of Authentication vulnerability

Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 18.11.31.62 allows authenticated administrator users -- administrators to Remove MVision Endpoint via unspecified vectors...

Jenkins < 2.160 and < 2.150.2 LTS Multiple Vulnerabilities - Linux

Jenkins and is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege Escalation

ansible is vulnerable to privilege escalation attacks. The vulnerability exists as Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

Privilege Escalation

xen is vulnerable to privilege escalation attacks. The vulnerability exists as the 1 ioportread and 2 ioportwrite functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-ran...

Denial Of Service (DoS)

mysql is vulnerable to denial of service. An unspecified vulnerability allows remote administrators to deny access to the server via vectors related to Server: InnoDB...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via...

Denial Of Service (Dos)

krb5 is vulnerable to denial of service. A NULL pointer dereference in the check16dummy function in lib/kadm5/srv/svrprincipal.c allows remote authenticated administrators with create privilege to crash the process...

Umbraco CMS 7.12.4 - (Authenticated) Remote Code Execution

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link:...

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12....

Umbraco CMS 7.12.4 Remote Code Execution

Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4 Category: Webapps Tested...