1042 matches found
Improper Privilege Management in gskinner/regexr
✍️ Description I managed to find a Critical IDOR in the https://github.com/gskinner/regexr/ . Any user is able to change the Visibility Status of any pattern set 📚 Proof of Concept 1: Go to https://regexr.com/ 2: Click on "New" in the Top Left Corner 3: Select Pattern Settings and Fill out "patter...
Improper Privilege Management in polonel/trudesk
💥 BUG external user can submit ticket even when its disabled 💥 SUMMURY external user can submit ticket even when its disabled 💥 STEP TO REPRODUCE 1. First from admin account goto settings--tickets and disallow Allow public tickets .\ So, external user cant create ticket using url...
Exploit for Improper Access Control in Citrix Gateway
Detect Citrix ADC SAML action or SAML iDP Profile config vulnera...
ZTE ZXHN H168N 信息泄露漏洞
The ZTE ZXHN H168N is a router from China's ZTE Corporation ZTE. The ZTE ZXHN H168N 3.5.0EG1T4TE suffers from an information disclosure vulnerability that originates from improper privilege settings, which can be exploited by an attacker with normal user privileges to obtain some sensitive user...
ZOLL Defibrillator Dashboard
1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: ZOLL Equipment: Defibrillator Dashboard Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Use of Hard-coded Cryptographic Key, Cleartext Storage of Sensitive Information, Cross-site...
Johnson Controls Metasys
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Metasys Servers, Engines, and Tools Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could give an authenticated...
MesaLabs AmegaView Improper Privilege Management Vulnerability
MesaLabs AmegaView is a continuous monitoring system CMS from MesaLabs USA. A security vulnerability exists in MesaLabs AmegaView 3.0 and earlier versions, which can be exploited by an attacker to elevate the privileges of the...
CVE-2021-22733
Improper Privilege Management vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause shell access when unauthorized code is loaded into the system folder...
CVE-2021-22732
Improper Privilege Management vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a code execution issue when an attacker loads unauthorized code on the web server...
CVE-2021-22733
CVE-2021-22733 affects Schneider Electric homeLYnk (Wiser For KNX) and spaceLYnk up to/including v2.60. Root cause: Improper Privilege Management enabling shell access when unauthorized code is loaded into the system folder. Impact (per sources): local access with high integrity and confidentiali...
CVE-2021-22732
CVE-2021-22732 affects Schneider Electric homeLYnk and spaceLYnk (Wiser For KNX) systems. The vulnerability is described as improper privilege management in homeLYnk/spaceLYnk versions up to V2.60 and earlier, enabling code execution if an attacker loads unauthorized code on the web server. Conne...
CVE-2020-10072
Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges CWE-280. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc...
Improper Privilege Management in dolibarr/dolibarr
💥 BUG unprivileged user can add personal email to another user. 💥 IMPACT user who dont have any access in "users and groups" can update users personal email. 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B...
Improper Privilege Management in dolibarr/dolibarr
💥 BUG unprivileged user can attach agenda with leave. 💥 IMPACT user who dont have any access in leave can add agenda to this leave 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B bellow permission for Agenda...
Improper Privilege Management in dolibarr/dolibarr
💥 BUG unprivileged user can download file of a agenda 💥 IMPACT user dont have access to specific agenda but still can download file uploaded to this agenda . 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B...
Improper Privilege Management in dolibarr/dolibarr
💥 BUG unprivileged user can edit/share linked file of a project . 💥 VIDEO https://drive.google.com/file/d/1YaiG0vjFTuqZRck7dMLqkhT7HSZqaEdu/view?usp=sharing 💥 STEP TO REPRODUCE 1. From admin account add user B as normal user .\ now give user B bellow permission for project module.\ ----Read...
Unnamed Vulnerability in Samsung SMR
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to SMR APR-2021 Release 1, which stems from improper privilege management that allows untrusted applications to delete certain loc...
VulnCheck KEV: CVE-2021-20021
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with...
Schneider Electric C-Bus Toolkit
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: C-Bus Toolkit Vulnerabilities: Improper Privilege Management, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow remote code...