CVE-2021-40415

CVE-2021-40415 concerns the Reolink RLC-410W (v3.0.0.136_20121102). The issue resides in the cgiserver.cgi function cgi_check_ability: several APIs (including most sensitive ones) have no explicit case, causing a default permission value of 7 to be applied. This allows a non-administrative (authe...

Cross-site Scripting (XSS) - Stored in admidio/admidio

Description When adding a menu after logging in with an administrator account, there is no verification of the URL value, so the XSS payload is stored in the DB. After that, when you click the saved menu, XSS is triggered. If an administrator adds a menu, normal users can click it too. Proof of...

Exploit for CVE-2021-36934

PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSA...

non-admin users can create integration role with administrator role

Impact non-admin users can create integration role with administrator role Patches We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...

GHSA-243Q-G9J3-QF6R non-admin users can create integration role with administrator role

Impact non-admin users can create integration role with administrator role Patches We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...

PT-2021-14707 · Xebialabs +1 · Jenkins Xebialabs Xl Deploy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier Description: An incorrect permission check in the Jenkins XebiaLabs XL Deploy Plugin allows attackers with Generic Create permission to connect to an attacker-specified URL using...

Error: "You cannot add apps at this time" on Receiver StoreFront

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Domain users receive the following error after logging in using Receiver for Website : “You cannot a...

Citrix Workspace App Assistance for Non-Admins

Clickhere to download Citrix Workspace App. You have been directed to this article because you have questions about or need assistance with Citrix Workspace app and you are NOT an administrator or technical contact for your organization. As a non-admin user of Citrix Workspace app, you must conta...

Opencast Access Control Error Vulnerability

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. An Access Control Error vulnerability exists in Opencast. The vulnerability stems from allowing the distribution of interludes with strict access rules wi...

CVE-2020-26194

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to exploit the vulnerability, leading to compromised cryptographic...

Selection of Accounts with more than one Store in Workspace App is not getting retained

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. If you select All accounts from the UI of the CWA for Windows for version 1909 or higher, the...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

Design/Logic Flaw

Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an...

Eaton Intelligent Power Manager (IPM) < 1.68 Multiple Vulnerabilities

Eaton Intelligent Power Manager IPM v1.67 and prior contain multiple vulnerabilities: - Improper Input Validation on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the...

CVE-2020-6652

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager IPM v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the...

Privilege escalation

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager IPM v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the...

CVE-2020-6652 Incorrect privilege assignment allowing non-admin users to upload config files

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager IPM v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the...

CVE-2020-6652

CVE-2020-6652 affects Eaton Intelligent Power Manager (IPM) v1.67 and earlier. The vulnerability is an incorrect privilege assignment that lets non-admin users upload system configuration files by sending specially crafted requests, potentially enabling manipulation of configurations with paramet...

CVE-2020-12687

An issue was discovered in Serpico before 1.3.3. The /admin/attacmentsbackup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users including administrators from the database...

PT-2020-19206

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager versions 1.67 and prior Description The issue allows non-admin users to upload system configuration files by sending specially crafted requests, potentially resulting in non-admin users manipulating system...