PT-2023-22960 · WordPress · Mstore Api

The MStore API WordPress plugin, specifically versions before 3.9.9, is affected by a security issue that allows visitors to create user accounts with a role of their choice via the wholesale REST API endpoint. This issue is only exploitable if the site owner has paid to access the plugin's pro...

Unrestricted Upload Of File

github.com/alist-org/alist is vulnerable to Unrestricted Upload Of File. The vulnerability exists due to faulty access control, which allows an attacker with a low-privileged account to upload arbitrary files...

CVE-2022-34755

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...

PT-2023-2949 · Schneider Electric · Easergy Builder Installer

Name of the Vulnerable Software and Affected Versions: Easergy Builder Installer versions 1.7.23 and prior Description: The issue is related to an uncontrolled search path element in the installer, which could allow an attacker with a local privileged account to execute arbitrary code during the...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

SUSE CVE-2013-3790

Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect integrity via unknown vectors related to Privileged Account...

SAP Host Agent Access Control Error Vulnerability

SAP Host Agent is a set of agent programs from SAP that supports a number of lifecycle management tasks such as operating system monitoring, database monitoring and system instance monitoring. An Access Control Error vulnerability exists in SAP Host Agent versions 7.21 and 7.22, which arises from...

PT-2023-13708 · Exfo · Exfo Bv-10 Performance Endpoint Unit

Name of the Vulnerable Software and Affected Versions: EXFO BV-10 Performance Endpoint Unit affected versions not specified Description: The issue concerns an undocumented hard-coded privileged user in the EXFO BV-10 Performance Endpoint Unit. This means that there is a user account with elevated...

CVE-2023-0012

In SAP Host Agent Windows - versions 7.21, 7.22, an attacker who gains local membership to SAPLocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAPLocaAdmin are denied the ability to logo...

CVE-2022-42473

A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose information via logging into the database using a privileged account without a password...

FortiSOAR - PostgreSQL DB access to local users

A missing authentication for critical function CWE-306 vulnerabilty in FortiSOAR's Postgres database may allow a local attacker to access sensitive information via logging into the database using a privileged account without a password...

GHSA-2P75-Q37P-F852 OctoPrint Improper Privilege Management vulnerability

OctoPrint prior to 1.8.3 allows a user with read access only to access a privileged user's account and functionality. Version 1.8.3 contains a patch for this issue...

CVE-2022-29730

USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. The credentials cannot be altered through normal operation of the device...

CVE-2022-29730

USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. The credentials cannot be altered through normal operation of the device...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

CVE-2021-22813

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products:...