1047 matches found
Improper Privilege Management in snipe/snipe-it
Description It was found that if a user is not having access to supplier module, he can access and view the supplier content. Proof of Concept 1. Create two users, one admin and one normal user 2. A normal user is not having access to the supplier module. 3. But by enumeration the normal user vie...
Improper Privilege Management in snipe/snipe-it
Description Unprivilege user can create maintainance for asset Proof of Concept 1. Create regular user and set DENY to all permissions in asset models.\ 2. Login as the user and sent bellow request to create maintainance for asset await fetch"https://demo.snipeitapp.com/hardware/maintenances",...
GHSA-F8VC-WFC8-HXQH Improper Privilege Management in Apache Hadoop
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification...
Siemens SIMATIC S7-1200 Improper Privilege Management (CVE-2016-2846)
Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a user program block protection mechanism via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable...
Improper Privilege Management in liangliangyy/djangoblog
Description Hi there, I would like to report an improper privilege management vulnerability in djangoblog source code. This would allow an attacker to create comment on behalf of anyone. Proof of Concept 1. Install a local instance of djangoblog, login as admin and create an article 2. Create a n...
PYSEC-2022-14
Improper Privilege Management in Conda loguru prior to 0.5.3...
Improper Privilege Management in liukuo362573/yishaadmin
Description Hi there, there is another improper privilege management in /admin/OrganizationManage/Position/GetFormJson Proof of Concept 1. Access the link http://106.14.124.170:80/admin/OrganizationManage/Position/GetFormJson?id=16508640061130139 2. See that the page return with position data...
Improper Privilege Management in liukuo362573/yishaadmin
Description Hi there yishaadmin maintainer team, I would like to report an improper privilege management in yishaadmin source code. The link /admin/ToolManage/Server/GetServerJson requires no authentication and accessible for everyone, which returns server info like RAM, CPU usage. Proof of Conce...
Improper Privilege Management in heroiclabs/nakama
Description A predefined View Only user has access to the User Management function at the :7351//users endpoint. By default this is a predefined system administrator function, and no other users should be able to access this function. Proof of Concept - Create a View-only user with the...
The vulnerability of the systemd service initialization and management subsystem, related to improper privilege assignment, allows a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the systemd service initialization and management subsystem is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...
Improper Privilege Management in delgan/loguru
BUG ======== unprivileged user can see log file and sensitive information disclosed SUMMURY ============ loguru create log file to store the log . Log may contain many sentsitive information like username,password,token,key etc .\ So, this log file should not accessed by other user .\ But when...
CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management...
DEBIAN-CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management...
CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management...
Input validation
shelljs is vulnerable to Improper Privilege Management...
UBUNTU-CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management...
CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management...
SUSE SLES12: libsnmp30 / libsnmp30-32bit / net-snmp / net-snmp-devel / perl-SNMP / etc (SUSE-SU-2022:0030-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0030-1 advisory. - CVE-2020-15862: Make extended MIB read-only bsc1174961 Tenable has extracted the preceding description block directly from the SUSE securi...
CVE-2021-39982
Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications...
Design/Logic Flaw
Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications...