1642 matches found
PYSEC-2020-162
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...
A Facebook Bug Exposed Anonymous Admins of Pages
A bad code update allowed anyone to easily reveal which accounts posted to Facebook Pages—including celebrities and politicians—for several hours...
Cisco Data Center Network Manager TrustedClientTokenValidator Hard-coded Cryptographic Key Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. The specific flaw exists within the processing of the dbadmin/addUser functionality. The issue results from trusting input that has been encrypted with a hard-coded...
Cisco Data Center Network Manager REST API Command Injection Vulnerability
Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A REST API command injection vulnerability exists in Cisco Data Center Network...
CVE-2016-1000028
Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. Tenable ID 5198...
Code injection
Cloud Foundry Cloud Controller API CAPI, version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins...
Design/Logic Flaw
Symantec Endpoint Protection SEP, prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password protection could by bypassed for individuals with local administrator rights...
CVE-2016-5337
The megasasctrlgetinfo function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information...
CVE-2018-1106
An authentication bypass flaw has been found in PackageKit that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system...
The vulnerability of the page handler /login_disconnect/disconnect_admins in the FortiOS operating system interface allows a hacker to trigger a service failure.
The vulnerability of the /logindisconnect/disconnectadmins page handler in the FortiOS operating system is due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to cause service failures by sending incorrect values to the application—values that are not...
The vulnerability of the page handler /login_disconnect/current_admins in the FortiOS operating system allows a hacker to upload arbitrary files to the device.
The vulnerability of the /logindisconnect/currentadmins page handler in the FortiOS operating system is related to access control errors. Exploiting this vulnerability allows a malicious actor to upload arbitrary files to a device using specially crafted POST requests...
Group admins can create users with IDs of system folders (NC-SA-2019-015)
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...
CVE-2019-1010310
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools Reminder Description .. Set the...
Code injection
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools Reminder Description .. Set the...
CVE-2019-1010310
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools Reminder Description .. Set the...
CVE-2018-14831
An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tpl/Add/id/ URI...
CVE-2018-20851
Helpy before 2.2.0 allows agents to edit admins...
CVE-2018-20851
Helpy before 2.2.0 allows agents to edit admins...