11511 matches found
CVE-2022-31267
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext '[email protected]\n\trole = "admin"' value...
CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
CVE-2022-29448
Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...
CVE-2021-36833
Authenticated admin or higher user role Stored Cross-Site Scripting XSS vulnerability in ibericode's MC4WP plugin = 4.8.6 at WordPress...
Hackers Gain Fileless Persistence on Targeted SQL Servers Using a Built-in Utility
Microsoft on Tuesday warned that it recently spotted a malicious campaign targeting SQL Servers that leverages a built-in PowerShell binary to achieve persistence on compromised systems. The intrusions, which leverage brute-force attacks as an initial compromise vector, stand out for their use of...
CVE-2022-30969
A cross-site request forgery CSRF vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator...
PicketLink does not properly check role based authorization
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...
GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...
GHSA-88F6-79X2-XQF3 Apache Jetspeed vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...
Cross-site Scripting (XSS)
Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the label value of an item or name of a role. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious...
GHSA-774G-R3FM-4V85 CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...
CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...
Improper Privilege Management in craftercms
A logged-in and authenticated user with a Reviewer Role may lock a content item...
GHSA-FJ9V-G8FW-VXMF Improper Privilege Management in craftercms
A logged-in and authenticated user with a Reviewer Role may lock a content item...
CVE-2021-23265
A logged-in and authenticated user with a Reviewer Role may lock a content item...
CVE-2021-23265
A logged-in and authenticated user with a Reviewer Role may lock a content item...
Information disclosure
A logged-in and authenticated user with a Reviewer Role may lock a content item...
CVE-2021-23265
Technical details about CVE-2021-23265 are not publicly provided in the supplied documents. The materials confirm a privilege-related issue in Crafter CMS allowing a Reviewer to lock content, but no specifics on affected versions or fix are included. Monitor for updates.
