200 matches found
JetBlue: Access to tomcat-manager with default creds
The Apache Tomcat/6.0.35 server used by a domain was vulnerable to improper authentication due to the use of default credentials, allowing unauthorized access to the admin manager. The vulnerability was discovered and reported...
CVE-2021-28652
A flaw was found in Squid. A parser validation bug could allow a trusted client with Cache Manager API access privileges to trigger memory leaks, potentially resulting in a denial of service against Squid. The highest threat from this vulnerability is to system availability. Mitigation To mitigat...
Moodle Teacher Enrollment Privilege Escalation to RCE
Moodle version 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions allow for a teacher to exploit chain to RCE. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other users, and thus look to add...
Cisco Wide Area Application Services (WAAS) HTTPS Proxy Authentication Bypass Vulnerability
Cisco Wide Area Application Services WAAS is a comprehensive WAN optimization solution that improves the performance of applications running in WAN environments, delivers video to branch offices and locally hosts branch office IT services. An authentication bypass vulnerability exists in the HTTP...
Qualys Cloud Platform 2.37 New Features
This release of the Qualys Cloud Platform version 2.37 includes updates and new features for Security Assessment Questionnaire and Web Application Scanning, highlights as follows. Security Assessment Questionnaire Manager access to all active campaigns – Questionnaire Manager role now has access ...
Popular WooCommerce WordPress Plugin Patches Critical Vulnerability
If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new vulnerability that could compromise your online store. Simon Scannell, a researcher at RIPS Technologies GmbH, discovered an arbitrary file deletion vulnerability in the popular WooCommerce...
CVE-2018-7572
Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privileges of Pulse Secure Client. The attacker must interrupt the client's network...
Improper access control
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have...
CVE-2017-15052
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...
RHEL 7 : kernel (RHSA-2016:1277)
An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
IBM Domino ZMerge Database Security Bypass
The version of IBM Domino formerly IBM Lotus Domino running on the remote host is affected by a security bypass vulnerability due to insufficient access control list ACL settings on the administration databases for ZMerge. An unauthenticated, remote attacker can exploit this issue to disclose...
CVE-2014-4793
IBM WebSphere MQ 8.x before 8.0.0.1 does not properly enforce CHLAUTH rules for blocking client connections in certain circumstances related to the CONNAUTH attribute, which allows remote authenticated users to bypass intended queue-manager access restrictions via unspecified vectors...
SurgeLDAP 1.0 Web Administration Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10294/info SurgeLDAP is an LDAP server implementation for Microsoft Windows and various Unix operating systems. It includes a built-in web server to permit remote user access via HTTP. It has been reported that the...
Security feature bypass
IBM WebSphere MQ 7.1, when an SVRCONN channel is used, allows remote attackers to bypass the security-configuration setup step and obtain queue-manager access via unspecified vectors...
CVE-2012-3295
IBM WebSphere MQ 7.1, when an SVRCONN channel is used, allows remote attackers to bypass the security-configuration setup step and obtain queue-manager access via unspecified vectors...
RogioBiz PHP File Manager 1.2 Administrative Bypass
bypass admin exploit Author: ItSecTeam download from:http://www.scriptingblog.com/download/RogioBizPHPfilemanagerV1.2.zip script:RogioBizPHPfilemanagerV1.2 dork:inurl:"/rbfminc/" ----------------------------------------- use:run this xpl and after runing eror Incorect username or password! now...
EZCMS <= 1.2 (bSQL/Admin Byapss) Multiple Remote Vulnerabilities
No description provided by source. -+================================================================================+- -+ EZCMS = 1.2 Multiple Remote Vulnerabilitys +- -+================================================================================+- Discovered By: t0pP8uZz Discovered On: 19 M...
Exploit Labs Security Advisory 2005.9
------------------------------------------------------------ - EXPL-A-2005-009 exploitlabs.com Advisory 038 - ------------------------------------------------------------ - Cool Cafe - AFFECTED PRODUCTS ================= Cool Cafe Chat 1.2.1 http://coolcafe.ca OVERVIEW ======== Cool Cafe features...
CVE-2002-0664
The default Access Control Lists ACLs of the administration database for ZMerge 4.x and 5.x provides arbitrary users including anonymous users with Manager level access, which allows the users to read or modify import/export scripts...
CVE-2002-0664
The default Access Control Lists ACLs of the administration database for ZMerge 4.x and 5.x provides arbitrary users including anonymous users with Manager level access, which allows the users to read or modify import/export scripts...