CVE-2019-11769

An issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative user requires entering administrative credentials into the GUI. Subsequently, these credentials are processed in Teamviewer.exe, which allows any application running in the same non-administrative user...

PT-2019-18166 · Ge · Ge Communicator

Name of the Vulnerable Software and Affected Versions: GE Communicator versions prior to 4.0.517 Description: The issue allows a non-administrative user to place malicious files within the installer file directory. This may enable an attacker to gain administrative privileges on a system during...

Authentication flaw

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The loginmgr.cgi file checks credentials...

Privilege Escalation

spacewalk-backend is vulnerable to privilege escalation attacks. The vulnerability exists as it was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

Users on IOS devices can not log into XenApp after upgrading to Citrix Workspace app for iOS, authentication broken in 17.08

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users on Ipad IOS devices can no longer log into XenApp after upgrading Citrix Receiver to Citrix...

Receiver throws the following error on connecting to the Store: An error has occurred in the script on this page - File://C:/Cusers/xxxx/AppData/Local/Citrix/SelfService/Web/xxxx/1/custom/script.js

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Receiver 4.9.2000 throws the following error on connecting to the Store: An error has occurred in th...

Authorization

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

Code injection

A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-in user input. SEP 14.0 and later are not impacted by this issue. A non-admin user would need to be able to save an executable file to disk and then be able t...

[ASA-201711-24] couchdb: multiple issues

Arch Linux Security Advisory ASA-201711-24 ========================================== Severity: High Date : 2017-11-16 CVE-ID : CVE-2017-12635 CVE-2017-12636 Package : couchdb Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-495 Summary ======= The package couchdb...

SUSE-SU-2017:1347-1 Security update for SUSE Manager Client Tools

The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. bsc1026633, CVE-2017-7470 Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib...

PT-2018-8388 · Red Hat +1 · Spacewalk-Channel +1

Name of the Vulnerable Software and Affected Versions: spacewalk-channel affected versions not specified Description: An issue was found in spacewalk-channel where a non-admin user or disabled users can perform administrative tasks due to an incorrect authorization check in the...

Error "Cannot Connect to Server" when configuring receiver externally

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. While configuring the receiver; We may get the error message still beacons are perfect to connect...

CVE-2016-10041

SPRECON-E Service Program (before 3.43 SP0) is affected. The issue stems from incorrect caching of client data that can enable privilege escalation after a non-admin user executes telegram simulation, given preconditions: a user creates an online-connection, is validly authenticated/authorized as...

ownCloud: Full Path Disclosure

When I was trying to upload a html file as profile picture as a non admin user. then it popped up with a message containing full path . Like that "Could not obtain lock type 1 on "/opt/lampp/htdocs/owncloud/data/12/files/opt/lampp/htdocs/owncloud/data/12/cache/avatarupload"." Thanks...

EasyCart 1.1.30 - 3.0.20 - Privilege Escalation

Due to a lack of validation in the ecajaxupdateoption and ecajaxclearalltaxrates functions located in /inc/admin/adminajaxfunctions.php, it is possible to update any WordPress option as an authenticated non-admin user, which can in turn lead to privilege escalation and remote code execution...

SePortal 2.5 SQL Injection / Remote Code Execution Exploit

This Metasploit module exploits a vulnerability found in SePortal version 2.5. When logging in as any non-admin user, it's possible to retrieve the admin session from the database through SQL injection. The SQL injection vulnerability exists in the "staticpages.php" page. This hash can be used to...

Quantum vmPRO 3.1.2 - Local Privilege Escalation

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Quantum vmPRO 3.1.2 and below ------------------------- Affected vendors: ------------------------- Quantum http://quantum.com/ ------------------------- Product description:...

Quantum vmPRO 3.1.2 Root Shell

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Quantum vmPRO 3.1.2 and below ------------------------- Affected vendors: ------------------------- Quantum http://quantum.com/ ------------------------- Product description:...

OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution

This module exploits a vulnerability found in OpenEMR version 4.1.1 Patch 14 and lower. When logging in as any non-admin user, it's possible to retrieve the admin SHA1 password hash from the database through SQL injection. The SQL injection vulnerability exists in the "newcomprehensivesave.php"...

Crowd OpenID server does not enforce profile ownership for viewing

Similar to CWD-3465, it seems that not enforce profile ownership for viewing. That is, a non-admin user called Mallory can view Alice's profile information if Mallory obtains Alice's profileId number. For example, https://openid.atlassian.com/secure/profile/editprofiles.action?profileID=15240744...