3187 matches found
CVE-2019-16957
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
Design/Logic Flaw
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
CVE-2019-16957
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
CVE-2019-16957
SolarWinds Web Help Desk 12.7.0 is affected by a Cross‑Site Scripting (XSS) vulnerability that can be triggered via the First Name field of a User Account. The issue is documented in CVE-2019-16957 and is consistently described across multiple feeds (NVD, Red Hat, CNVD, CVE lists). The connected ...
CVE-2020-25618
An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root i.e., the use of root privileges is not limited to specific programs listed in the sudoers fi...
Privilege Escalation
libpam-sshauth is vulnerable to privilege escalation. The pamsmauthenticate function in pamsshauth.c allows a context-dependent attackers to bypass authentication or gain privileges via a system user account...
EgavilanMedia User Registration And Login System With Admin Panel 1.0 CSRF
Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF Date: 01-12-2020 Exploit Author: Hardik Solanki Vendor Homepage: http://egavilanmedia.com Software Link:...
EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF
Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF Date: 01-12-2020 Exploit Author: Hardik Solanki Vendor Homepage: http://egavilanmedia.com Software Link:...
The vulnerability of the APTARE data management platform, related to bypassing the authentication process, allows attackers to gain access to data and functions that are available to the target user account.
The vulnerability of the APTARE data management platform relates to the bypassing of the authentication process. Exploiting this vulnerability allows a malicious actor to gain access to data and functions that are available to the target user account...
Post Breach, Peatix Data Reportedly Found on Instagram, Telegram
Event-discovery application Peatix has disclosed a data breach, after ads for stolen user-account information were reportedly being circulated on Instagram and Telegram. In a data breach notice to affected users, Peatix said it learned on Nov. 9 that user account data had been improperly accessed...
Xxe
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the...
XML External Entity in Dashboard Widget
Problem It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At leas...
CVE-2020-1778 Bypassing user account validation
When OTRS uses multiple backends for user authentication with LDAP, agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions...
Default configuration
The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for...
openGauss: Configuring the Validity Period of User Roles
When creating a role, you can use the keyword VALID BEGIN to set the start time of the role validity period and use VALID UNTIL to set the end time. If these two keywords are not set, roles are permanently valid. The role expiration time on each node in openGauss depends on the OS clock on each...
Citrix UPS Print Driver Certification Tool
Where to download ? Certain legacy Citrix tools are now available on request only. Please submit the request here - https://forms.gle/obA39PEz5qpDiSPq8 Once we verify your request, we will provide access to the download location. Description The Citrix UPS Print Driver Certification Tool can be...
CVE-2020-15949
Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover...
CVE-2020-15949
Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover...
CVE-2020-16259
Affected product: Winston 1.5.4 devices. Issue: an SSH user account is accessible from bastion hosts, described as undocumented and not announced to users. This root cause enables full compromises of confidentiality, integrity, and availability per CVSS 3.1/5.0? (from the CVE data: attacker could...