CVE-2020-14617

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Platform, Mobile App. Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.12; Mobile App: Prior to 20.6. Easily exploitable vulnerability allows low privileged attacker with...

CVE-2020-4512

IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands...

Security Bulletin: IBM QRadar SIEM is vulnerable to command injection (CVE-2020-4512)

Summary IBM QRadar SIEM could allow a remote privileged user to execute commands. Vulnerability Details CVEID: CVE-2020-4512 DESCRIPTION: IBM QRadar SIEM could allow a remote privileged user to execute commands. CVSS Base score: 9.1 CVSS Temporal Score: See:...

CVE-2020-8197

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands...

CVE-2020-13994

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker...

Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Multiple cross-site scripting vulnerabilities in Testimonials Widget 3.5.1 and lower allow remote attackers to inject arbitrary Javascript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL Successful exploitation of this vulnerability would allow...

CVE-2020-15469

A NULL pointer dereference flaw was found in various system emulators of QEMU that occurs while performing MMIO r/w operations when the respective handler function is not defined. This flaw allows a privileged guest user to invoke the MMIO operation to crash the QEMU process on the host, resultin...

Shopify: Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT

Using the Shopify ping application a user can communicate with the kit. The kit is an application that creates tasks based on the information supplied through the Shopify ping app by a user. With a few quick messages to Kit using Shopify Ping, a user can create a discount code and promote it, sta...

CVE-2020-13443

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges member is able to upload this. It is possible to bypass the MIME type check and file-extension check...

CVE-2020-10277

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files such as the shadow file or privilege escalation by manually adding a new user with sudo privileges on the machine...

CVE-2020-14974

The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes even ones running as SYSTEM that hold a handle, via IOCTL code 0x222124...

Code injection

The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes even ones running as SYSTEM that hold a handle, via IOCTL code 0x222124...

CVE-2020-14974

The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes even ones running as SYSTEM that hold a handle, via IOCTL code 0x222124...

CVE-2020-14945

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

Shopify: Low Privileged user can add or remove cash to/from sales register

Low privileged user having no access to Shopify POS and very low permission set is not allowed to add cash to the sales register or remove cash from the sales register. But missing server-side permission checks on the vulnerable request allows a low privileged user to do this. A low privileged ca...

CVE-2020-12114

A flaw was found in the Linux kernel’s implementation of the pivotroot syscall. This flaw allows a local privileged user root outside or root inside a privileged container to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the...

Testimonial Rotator < 3.0.3 - Authenticated Stored Cross-Site Scripting (XSS)

A Stored XSS vulnerability has been found in the 'Author Information' textarea in testimonials from the plugin, which could allow an authenticated medium-privileged user contributor+ to inject arbitrary JavaScript. The XSS will be triggered for anyone visiting public posts or testimonial page...

CVE-2020-7499

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause unauthorized access when a low privileged user makes unauthorized changes...

Authorization

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause unauthorized access when a low privileged user makes unauthorized changes...

CVE-2020-7499

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause unauthorized access when a low privileged user makes unauthorized changes...