4497 matches found
CVE-2017-6823
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action...
Design/Logic Flaw
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL...
Design/Logic Flaw
NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the ownerrights ACL entry...
PYSEC-2017-57
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
CVE-2016-6189
CVE-2016-6189 affects SOGo before 2.3.12 and 3.x before 3.1.1. An incomplete blacklist allows remote authenticated users to read sensitive fields in calendar feeds (ICS and XML), exposing calendar data. Impacts are limited to reading potentially sensitive information; no exploitation details are ...
PT-2017-8927 · Inverse · Sogo
Name of the Vulnerable Software and Affected Versions: SOGo versions prior to 2.3.12 SOGo versions 3.x prior to 3.1.1 Description: The issue allows remote authenticated users to obtain sensitive information by reading specific fields in calendar feeds. This is due to an incomplete blacklist...
OpenText Documentum Content Server 7.3 SQL Injection
CVE Identifier: CVE-2017-5585 Vendor: OpenText Affected products: OpenText Documentum Content Server 7.3 PostgreSQL builds only Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fix: not available Description: Previously announced fix for...
Advantech WebAccess < 6.0-2008.06.06 Remote Authentication Bypass
Binary data 9951.prm...
CVE-2016-3063
NetApp OnCommand System Manager contains an input-escaping flaw that affects versions before 8.3.2. Due to improper escaping of special characters, remote authenticated users can trigger arbitrary API calls via unspecified vectors. Impact is the ability to perform unintended API operations, with ...
CVE-2015-8322
CVE-2015-8322 affects NetApp OnCommand System Manager 8.3.x prior to 8.3.2. The vulnerability allows remote authenticated users to execute arbitrary code via unspecified vectors. The connected documents do not specify the exact root cause, attack vectors, exploitation details, or affected subvers...
CVE-2016-3063
Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execute arbitrary API calls via unspecified vectors...
CVE-2015-4049
Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service data corruption or system crash via vectors related to using program operators during EPSILON level 5 based codefiles at...
CVE-2016-8918
IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials...
CVE-2016-8918
IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials...
Default configuration
IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials...
Design/Logic Flaw
The handlecertificate function in /vmi/manager/engine/management/commands/apnsworker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to api/v1/cfg/oauth/saveidentifypfx/...
UBUNTU-CVE-2016-4340
The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors...
CVE-2016-4340
Removed by vendor...