289 matches found
PYSEC-2020-246
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28735
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
CVE-2020-28735
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
CVE-2020-28735
CVE-2020-28735 affects Plone versions before 5.2.3, where the tracebacks feature (accessible to the Manager role) enables SSRF attacks. The issue is described across multiple sources as a vulnerability in Plone prior to 5.2.3 that allows server-side request forgery via tracebacks. Remediation is ...
CVE-2020-28734
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28734
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28736: Improper Restriction of XML External Entity Reference
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2020-28734: Improper Restriction of XML External Entity Reference
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28735: Server-Side Request Forgery (SSRF)
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
PT-2022-8563 · Moodle +1 · Moodle +1
Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.9.1 Moodle versions prior to 3.8.4 Moodle versions prior to 3.7.7 Moodle versions prior to 3.5.13 Description: The issue allows teachers of a course to assign themselves the manager role within that course...
CVE-2019-6653: Improper Neutralization of Input During Web Page Generation
There is a Stored Cross Site Scripting vulnerability in the undisclosed page of a BIG-IQ 6.0.0-6.1.0 or 5.2.0-5.4.0 system. The attack can be stored by users granted the Device Manager and Administrator roles...
Design/Logic Flaw
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role...
Physician, protect thyself: An ounce of prevention is worth a pound of cure
In part one of our Physician, protect thyself series, we recognized significant security problems within the healthcare industry that need addressing. Health organizations moving from the paper to the 'puter—a shift meant to improve care and overall patient experience—inadvertently introduced...
PT-2018-8299
Name of the Vulnerable Software and Affected Versions F5 BIG-IQ Centralized Management versions 5.1.0 through 5.2.0 Description A local user with the Access Manager role has the ability to change the passwords of other users on the system, including the local admin account password. Recommendatio...
New Relic: User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditions
Details The endpoints POST /v2/accounts/:accountid/alerts/conditions create new and PUT /v2/accounts/:accountid/alerts/conditions/:conditionid update existing on infrastructure-alert.service.newrelic.com are vulnerable to privilege escalation. As per the screenshot below, an account with regular...
Privilege Escalation
Moodle is vulnerable to privilege escalations. On big installations, when the sync script was run it would improperly assign a manager role to suspended student accounts, granting these accounts the same access rights as a manager role...
Privilege Escalation
Moodle is vulnerable to privilege escalation attacks. The attacks are possible due to a flaw in the self-enrollment functionality. The flaw allows an authenticated user to leverage a role from teacher to manager level without authorization...
Harvest: Editing a project (LIMITED)
Hey there, I found out that invited user to a project cannot edit the project settings unless he is a PROJECT MANAGER on it. Now there is an option while editing project to make it BILLABLE OR NOT... When it is NOT billable it is quite impossible to BILL an invoice for it without making it...
foreman: edit_users permission allows changing of admin passwords
It was discovered that in Foreman the editusers permissions for example, granted to the Manager role allowed the user to edit admin user passwords. An attacker with the editusers permissions could use this flaw to access an admin user account, leading to an escalation of privileges...
