Moodle 访问控制错误漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle, which stems from the fact that a user typically a course administrator with "logged in as"...

GaussDB Kernel: Enabling the Separation of Duties

If the parameter enableSeparationOfDuty is set to on, the separation of duties is enabled to control system administrator permissions. In this mode, system administrators cannot create or modify user configurations or access data in private users SPDX-FileCopyrightText: 2020 Greenbone AG Some tex...

GaussDB Kernel: Checking the Administrator Whose ID Is 10

The system administrator with the ID 10 has the highest database permissions, that is, has all system and object permissions. It is recommended that this user be used only for DBA management instead of service applications. Carefully check the operation records of this system administrator...

openGauss: Checking the Administrator Whose ID Is 10

The system administrator with the ID 10 has the highest database permissions, that is, has all system and object permissions. It is recommended that this user be used only for DBA management instead of service applications. Carefully check the operation records of this system administrator...

openGauss: Setting the Number of Connections Used by System Administrators

sysadminreservedconnections indicates the minimum number of connections reserved for the openGauss system administrator. The value of this parameter must be less than that of maxconnections. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

openGauss: Enabling the Separation of Duties

If the parameter enableSeparationOfDuty is set to on, the separation of duties is enabled to control system administrator permissions. In this mode, system administrators cannot create or modify user configurations or access data in private users SPDX-FileCopyrightText: 2020 Greenbone AG Some tex...

CVE-2020-22275

Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...

BaserCMS Remote Code Execution Vulnerability

BaserCMS is an open source enterprise-level content management system cms. A remote code execution vulnerability exists in the editor template in versions of baserCMS prior to 4.4.1. The vulnerability can be exploited by a system administrator to achieve remote code execution by uploading an...

Remote code execution

baserCMS before version 4.4.1 is affected by Remote Code Execution RCE. Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1...

CVE-2020-14742

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having SYSDBA level account privilege with network access via Oracle Net to...

CVE-2020-15598

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial...

CVE-2020-17384 Cellopoint CelloOS - Remote Command Execution (RCE)

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system...

PT-2020-14935 · Cellopoint · Cellopoint Cellos

Name of the Vulnerable Software and Affected Versions: Cellopoint Cellos version 4.1.10 Build 20190922 Description: The issue arises from improper validation of URL input. An attacker can exploit this by injecting and remotely executing arbitrary commands to manipulate the system, provided they...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname...

CVE-2020-5362

Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup...

USN-4359-2: APT vulnerability

USN-4359-1 fixed a vulnerability in APT. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM. Original advisory details: It was discovered that APT incorrectly handled certain filenames during package installation. If an attacker could provide a specially crafted...

USN-4359-1 apt vulnerability

It was discovered that APT incorrectly handled certain filenames during package installation. If an attacker could provide a specially crafted package to be installed by the system administrator, this could cause APT to crash...

SAP Adaptive Server Enterprise Information Disclosure Vulnerability (CNVD-2020-29752)

SAP Adaptive Server Enterprise is a relational database server from SAP. An information disclosure vulnerability exists in SAP Adaptive Server Enterprise. An attacker could exploit this vulnerability to read the system administrator password via certain misconfigured endpoints that are publicly...

Atlassian Jira 8.2 < 8.5.4 Support Files Improper Authorization Vulnerability (JRASERVER-70564)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 8.2.x prior to 8.5.4. It is, therefore, affected by an improper authorization vulnerability. Support zip files could be downloaded by a system administrator user without...

[SECURITY] Fedora 31 Update: sudo-1.9.0-0.1.b1.fc31

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...