Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...

CVE-2017-18876

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file...

CVE-2017-18876

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file...

CVE-2017-18875

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files...

CVE-2017-18875

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files...

CVE-2019-20886

An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...

CVE-2019-20886

An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...

CVE-2017-18875: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files...

CVE-2016-11077: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...

PT-2020-10850

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description An issue was discovered where the first user is sometimes inadvertently given system admin privileges. Recommendations For versions prior to 5.8.0, update to version 5.8.0 or later to resol...

CVE-2019-20886: Improper Privilege Management

An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...

CVE-2017-18874: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal...

Nextcloud: External storage app saves password for all users in the database

External storage filesexternal app save passwords of all users to database table "occredentials" even when "Log-in credentials, save in database" option is not used. It's a security risk that allow password extraction of all users. A local system admin that has access to database and nextcloud...

Sangoma FreePBX Command Execution Vulnerability

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A security vulnerability exists in FreePBX versions 13, 14, and 15 and in the System Admin sysadmin module prio...

Verodin Director Web Console 3.5.4.0 Password Disclosure

Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/ Software Link : https://www.verodin.com/demo-request/demo-request-form Tested Versions...

Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)

Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/...

Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure Exploit

Exploit for jsp platform in category web applications Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/ Software Link :...

CVE-2019-14220

CVE-2019-14220 affects BlueStacks 4.110 and earlier on macOS, and 4.120 and earlier on Windows. A vulnerability in a system service call allows a local attacker to read arbitrary files with SYSTEM privileges by passing a file name to the affected method inside the Android VM used by BlueStacks, e...

PT-2019-13540

Name of the Vulnerable Software and Affected Versions BlueStacks versions 4.110 and below on macOS BlueStacks versions 4.120 and below on Windows Description The issue concerns a local arbitrary file read through a system service call. It affects the method that runs with System admin privilege,...

CVE-2019-14220: Improper Privilege Management

An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine VM to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method...