1580 matches found
CVE-2020-12687: Exposure of Resource to Wrong Sphere
An issue was discovered in Serpico before 1.3.3. The /admin/attacmentsbackup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users including administrators from the database...
CVE-2020-6652: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager IPM v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the...
PT-2020-19206
Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager versions 1.67 and prior Description The issue allows non-admin users to upload system configuration files by sending specially crafted requests, potentially resulting in non-admin users manipulating system...
CVE-2020-6652
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager IPM v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the...
CVE-2020-3951
VMware Workstation 15.x before 15.5.2 and Horizon Client for Windows 5.x and prior before 5.4.0 contain a denial-of-service vulnerability due to a heap-overflow issue in Cortado Thinprint. Attackers with non-administrative access to a guest VM with virtual printing enabled may exploit this issue ...
Visma Bug Bounty Program: A non-administrator user can change his email even when it is restricted by an administrator
A non-administrator user can change his email, even when it is restricted by an administrator, by tampering with the response data. Steps to Reproduce Login as a normal user and goto "My details" tab in Profile. Click on Edit icon in Account section. If this functionality is locked by your...
openstack-keystone: Credentials API allows non-admin to list and retrieve all users credentials
A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforcescope is false. Information for time-based one time passwords TOTP may also be disclosed. Deployments running keystone...
Unable to add Store to Workspace App on Windows - Your account cannot be added using this server address
This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information Unable to add Store to Workspace App on Windows and Mac Client machines...
CVE-2019-19894
In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker non-admin can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP...
CVE-2019-15011
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
CVE-2019-15011
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
CVE-2019-15011: Incorrect Default Permissions
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
PT-2019-13935
Name of the Vulnerable Software and Affected Versions Application Links versions 5.0.0 through 5.0.11 Application Links versions 5.1.0 through 5.2.10 Application Links versions 5.3.0 through 5.3.6 Application Links versions 5.4.0 through 5.4.12 Application Links versions 6.0.0 through 6.0.4...
CVE-2019-16861
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library DLL. The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated...
CVE-2019-15799
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH while their...
Default credentials
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH while their...
CVE-2019-18384
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...
CVE-2019-6144
This vulnerability allows a normal non-admin user to disable the Forcepoint One Endpoint versions 19.04 through 19.08 and bypass DLP and Web protection...