Improper access control

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perform unauthorized operations on the router...

CVE-2018-11785

Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query...

CVE-2018-18422

UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/aadminx.php?x=a URI...

Cross site request forgery (csrf)

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-17855

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

CVE-2018-1593

IBM Multi-Cloud Data Encryption MDE 2.1 could allow an unauthorized user to manipulate data due to missing file checksums. IBM X-Force ID: 143568...

CVE-2018-1593

IBM Multi-Cloud Data Encryption MDE 2.1 could allow an unauthorized user to manipulate data due to missing file checksums. IBM X-Force ID: 143568...

CVE-2018-16713

IObit Advanced SystemCare, which includes Monitorwin10x64.sys or Monitorwin7x64.sys, 1.2.0.5 and possibly earlier versions allows a user to send an IOCTL 0x9C402084 with a buffer containing user defined content. The driver's subroutine will execute a rdmsr instruction with the user's buffer for...

CVE-2018-3679

Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remote unauthenticated user to potentially execute code via administrator privileges...

Foreman < 1.14.0 Information Disclosure Vulnerability

Foreman is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:theforeman:foreman";...

CVE-2016-7077

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6...

Cross site request forgery (csrf)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2017-2590

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of servic...

CVE-2018-13445

An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...

CVE-2018-11371

CVE-2018-11371 affects SkyCaiji 1.2, where a cross-site request forgery (CSRF) enables an attacker to add an Administrator user. The connected documents consistently describe SkyCaiji 1.2 CSRF as the root issue leading to privilege escalation via account creation. No fixes, mitigations, or patch ...

WUZHI CMS 4.1.0 - Cross-Site Request Forgery (Add User)

WUZHI CMS 4.1.0 - Cross-Site Request Forgery Add User Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add user account Date: 2018-04-10 Exploit Author: taoge Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE :...

CVE-2018-7524

A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an unauthorized user to be added to the system...

CVE-2018-7524

A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an unauthorized user to be added to the system...