1596 matches found
CVE-2019-3720
Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated malicious user with admin privileges could potentially exploit this vulnerability to gain unauthorized access to the file system by exploiting insufficient...
CVE-2018-19512
In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated administrator users, because PHP files are restored under the document root directory...
CVE-2018-12237
The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges...
CVE-2018-12237
The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges...
CVE-2018-20159
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...
CVE-2018-20156
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network...
krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service NULL pointer dereference or bypass a DN container check by supplying tagged data that is internal to the database module...
CVE-2018-0440
A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP...
CVE-2018-6678
Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway MWG MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors...
Hanno's projects: SQL injection in Serendipity (serendipity_fetchComments)
Summary An authenticated administrator can alter Entries to display on frontpage and Entries to display in Feeds in a way to perform a SQL injection and extract database records or access files on the underlying system. Description The function serendipityfetchComments implemented in...
Windows Host Compute Service Shim Remote Code Execution Vulnerability
Microsoft Windows 10 and others are a series of operating systems released by the American company Microsoft. A remote code execution vulnerability exists when the Windows Host Computing Services Shim hcsshim library fails to properly validate input when importing container images. An attacker...
CVE-2017-15635
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the maxconn variable in the sessionlimits.lua file...
CVE-2017-15614
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the pptpclient.lua file...
Code injection
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privileges via unspecified vectors...
Information Disclosure
Moodle is susceptible to information disclosure. The vulnerability exists because the library records the password in plain text in the config log report, allowing an authenticated administrator to view the passwords when accessing the report...
CVE-2016-9092
The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...
CVE-2016-9091
Blue Coat Advanced Secure Gateway ASG 6.6 before 6.6.5.4 and Content Analysis System CAS 1.3 before 1.3.7.4 are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges...
CVE-2016-8998
IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference : 1998747...