11511 matches found
CVE-2022-29452
Authenticated editor or higher user role Stored Cross-Site Scripting XSS vulnerability in Export All URLs plugin = 4.1 at WordPress...
CVE-2022-28612
Improper Access Control vulnerability leading to multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Muneeb's Custom Popup Builder plugin = 1.3.1 at WordPress...
CVE-2022-29443
Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Nicdark's Hotel Booking plugin = 3.0 at WordPress...
CVE-2022-29438
Authenticated author or higher user role Persistent Cross-Site Scripting XSS vulnerability in Image Slider by NextCode plugin = 1.1.2 at WordPress...
CVE-2022-29440
Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Promotion Slider plugin = 3.3.4 at WordPress...
CVE-2022-29440 WordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Promotion Slider plugin = 3.3.4 at WordPress...
Money Transfer Management System Elevation of Privilege Vulnerability
Money Transfer Management System is a remittance management system.An elevation of privilege vulnerability exists in Money Transfer Management System version 1.0. A remote attacker can exploit this vulnerability to gain elevated privileges to the Admin role via any URL...
PT-2022-21177 · Siemens · Sinema Remote Connect Server
Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A missing authentication verification for a resource used to change the roles and permissions of a user has been identified. This could allow an attacker to change the permissio...
CVE-2022-32562
An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission...
CVE-2022-32560
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...
CVE-2022-32560
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...
CVE-2022-32560
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...
Code injection
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...
CVE-2022-32560
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...
CVE-2022-1658
Vulnerable versions of the Jupiter Theme = 6.10.1 allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abbremoveplugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, an...
Couchbase Server 授权问题漏洞
Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in versions of Couchbase Server prior to 7.0.4, which stems from a lack of role checki...
CVE-2021-44582
A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...
CVE-2021-44582
A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...
CVE-2021-44582
CVE-2021-44582 affects Sourcecodester Money Transfer Management System 1.0. A remote attacker can escalate privileges to Admin via any URL. Documents cite network-based, low-attack-complexity access with single authentication and high impact (confidentiality, integrity, availability) per CVSS v3....
Reddit: Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.
ads.reddit.com is an ads creating and managing application for reddit. The application has the feature to invite other members to the organization and give different roles at ad management. Testing around the role management functionalities, I have noticed that a user with the same email can get...