CVE-2019-10632

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...

Zyxel NAS 326 Directory Traversal Vulnerability

The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel. A directory traversal vulnerability exists in the File Browser component of the Zyxel NAS 326 5.21 and earlier versions. A low-privileged user can exploit this vulnerability to change the location of any other user's files...

CVE-2018-1623

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 144408...

Override access vulnerability in de*** module of LaySNS lightweight content community system of Wuhan ClassSen Technology

LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. A vulnerability exists in the de module of the LaySNS lightweight content community system in Wuhan Classen Technology. The vulnerability stems from the...

Design/Logic Flaw

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability such as administrators/managers can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped whe...

CVE-2018-17542

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the selectmid parameter in an letgo.cgi request...

CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

Information leakage vulnerability in the "personal data" section of the Palm Parent App

Palm Good Parent App is an educational software for parents. An information leakage vulnerability exists in the "Personal Information" section of Palm Parent App. Attackers can obtain information about other users by tampering with packets...

CVE-2018-16162

OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors...

Unspecified Vulnerability in IBM WebSphere Portal (CNVD-2018-24843)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A security vulnerability exists in IBM WebSphe...

CVE-2016-9489

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change...

UBUNTU-CVE-2018-10889

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester...

UBUNTU-CVE-2018-1116

A flaw was found in polkit before version 0.116. The implementation of the polkitbackendinteractiveauthoritycheckauthorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and informati...

CVE-2018-7681

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-1136

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

CVE-2017-8187

Huawei FusionSphere OpenStack V100R006C00SPC102NFV has a privilege escalation vulnerability. Due to improper privilege restrictions, an attacker with high privilege may obtain the other users' certificates. Successful exploit may cause privilege escalation...

kernel: improper keyrings creation

A flaw was found in the Linux kernel in the way a local user could create keyrings for other users via keyctl commands. This may allow an attacker to set unwanted defaults, a denial of service, or possibly leak keyring information between users...

Synology Surveillance Station File and Directory Information Disclosure Vulnerability

Synology Surveillance Station is a video management application from Synology, and User Profile is one of the user information storage files. An information disclosure vulnerability exists in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station versions prior to...

TIBCO tibbr web server component elevation of privilege vulnerability

TIBCO tibbr is a set of enterprise social platform software from TIBCO Software. The software includes features for posting news, making announcements, and sharing online. tibbr web server is one of the web server components. A security vulnerability exists in the tibbr web server component of...

CA Identity Governance Cross-Site Scripting Vulnerability

CA Identity Governance is a suite of identification and management solutions from CA USA. A cross-site scripting vulnerability exists in CA Identity Governance version 12.6. A remote attacker could exploit the vulnerability to display HTML or execute scripts in the context of other users...