528 matches found
Digi International Digi TransPort 安全漏洞
The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi International Digi TransPort, which can be exploited by an authenticated attacker to read a password file passwords are reversible from the device, whi...
CVE-2021-24842
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1 list private post titles of other users and 2 change the posted date of other users' posts...
UBUNTU-CVE-2021-43560
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...
CVE-2021-42078
PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...
Fortinet FortiManager 信息泄露漏洞
Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...
CVE-2021-33679
The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...
CVE-2020-29012
An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...
CVE-2021-24501
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site...
Moodle 安全漏洞
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from insufficient permission checking when deleting messages. A remote user can...
CVE-2020-26801
A stored cross-site scripting XSS vulnerability was discovered in /Forms/devicevars1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request...
LabCup 授权问题漏洞
LabCup is a laboratory and research organization software management system from LabCup Ireland. It helps academic researchers and safety officers with chemical inventory management, risk assessment and compliance. An authorization issue vulnerability exists in LabCup, which arises from the abili...
CVE-2020-36007
AppCMS 2.0.101 in /admin/template/tplapp.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive information of other users...
AppCMS 跨站脚本漏洞
AppCMS is a content management system CMS for mobile application downloads. A cross-site scripting vulnerability exists in AppCMS version 2.0.101, which can be exploited by an attacker to obtain sensitive information about other users...
CVE-2021-20575
IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278...
IBM Cloud Pak for Multicloud Management 安全漏洞
IBM Cloud Pak for Multicloud Management is an application from IBM, USA. used to manage the default functionality of a multi-cloud environment. A security vulnerability exists in IBM Cloud Pak for Multicloud Management that allows web pages to be stored locally and can be read by other users on t...
CVE-2021-24197
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by takin...
CVE-2021-21533
Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details...
CVE-2020-4726
The IBM Application Performance Monitoring UI IBM Cloud APM 8.1.4 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975...
CVE-2020-35568
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the...