Event Banner <= 1.3 - Arbitrary File Upload to RCE

The plugin does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation chec...

Authorization

A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to the Cisco Webex Meetings...

CVE-2021-1467 Cisco Webex Meetings for Android Avatar Modification Vulnerability

A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to the Cisco Webex Meetings...

CVE-2021-1467

CVE-2021-1467 affects Cisco Webex Meetings for Android. The issue stems from improper authorization checks, allowing an authenticated remote actor in the same meeting to modify another user’s avatar by sending a crafted request to the targeted Webex client. Impact is limited to avatar modificatio...

PT-2021-2562 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings for Android affected versions not specified Description: A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This issue is due to imprope...

CVE-2021-24146

CVE-2021-24146 affects WordPress Modern Events Calendar Lite (versions before 5.16.5). The flaw is lack of proper authorization checks that do not restrict access to exported event files, allowing unauthenticated users to retrieve all events data in CSV or XML formats. Affected plugin: Modern Eve...

SAP Enterprise Financial Services Elevation of Privilege Vulnerability (CNVD-2021-18017)

SAP Enterprise Financial Services is a set of enterprise financial services solutions from SAP. A security vulnerability exists in SAP Enterprise Financial Services versions 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, and 800, which arises from a program that does not perform...

SAP Stomps Out Critical RCE Flaw in Manufacturing Software

Enterprise software giant SAP pushed out fixes for a critical-severity vulnerability in its real-time data monitoring software for manufacturing operations. If exploited, the flaw could allow an attacker to access SAP databases, infect end users with malware and modify network configurations. The...

CVE-2021-21487

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2021-21487

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2021-21486

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

Authorization

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2021-21486

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2021-21487

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

Authorization

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2021-21487

CVE-2021-21487 affects SAP Payment Engine version 500. The root cause is missing authorization checks for an authenticated user, enabling elevation of privileges. Exploitability is network-based with authenticated access; no in-document exploitation details are provided. References indicate SAP s...

CVE-2021-21487

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2021-21486

CVE-2021-21486 affects SAP Enterprise Financial Services versions 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, and 800, where an authenticated user can bypass authorization checks and escalate privileges. The issue’s root cause is improper authorization checks within the SAP E...

CVE-2021-21486

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CentOS 8 : postgresql:12 (CESA-2020:5620)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5620 advisory. - postgresql: Uncontrolled search path element in logical replication CVE-2020-14349 - postgresql: Uncontrolled search path element in CREATE EXTENSION...