3187 matches found
Cloud Foundry UAA Elevation of Authority Vulnerability
UAA is a multi-tenant identity management service used in Cloud Foundry and can also be used as a standalone OAuth2 server. An elevation of privilege vulnerability exists in Cloud Foundry UAA versions prior to 74.1.0. The vulnerability stems from the fact that UAA can request a scope for a client...
CVE-2019-16706
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cmsuseradd.php...
CVE-2019-16706
The CVE-2019-16706 entry concerns kkcms v1.3, where a CSRF vulnerability allows an attacker to add a new user via admin/cms_user_add.php. The vulnerability affects the CMS component responsible for user management and is evidenced by multiple feeds (NVD entry notes CSRF with impact to confidentia...
Dante SOCKS5 server with authentication
It's not so obvious that socks servers with authentication are a necessary thing. 1. You can run a "local socks service" simply by connecting to a remote host via ssh with -D 2. Most of software products, that support socks, don't support socks servers with authentication The last fact I find ver...
CVE-2019-14254
Summary (CVE-2019-14254) : The issue affects Publisure version 2.1.2 secure portal. SQL injections in the file userAccFunctions.php allow an attacker to extract passwords and grant access to the user account “user” to become Administrator . Exploitation details are corroborated by multiple source...
CVE-2019-14254
An issue was discovered in the secure portal in Publisure 2.1.2. Because SQL queries are not well sanitized, there are multiple SQL injections in userAccFunctions.php functions. Using this, an attacker can access passwords and/or grant access to the user account "user" in order to become...
CVE-2019-13140
CVE-2019-13140 affects Inteno EG200 series (EG200-WU7P1U_ADAMO3.16.4-190226_1650 and older). A JUCI ACL misconfiguration allows the non‑privileged user to extract the 3DES key via ubus JSON commands, enabling decryption of the provisioning file provided by Adamo Telecom from a public HTTP URL. Im...
CentOS Web Panel Input Validation Error Vulnerability (CNVD-2019-32252)
CentOS Web Panel CWP is a free web hosting control panel. An input validation error vulnerability exists in CentOS Web Panel version 0.9.8.851, which can be exploited by an attacker to change the email password in an affected user account...
CentOS Web Panel elevation of privilege vulnerability (CNVD-2019-32250)
CentOS Web Panel is a Linux web hosting control panel. An elevation of privilege vulnerability exists in CentOS Web Panel, which can be exploited by an attacker to change the value of an email exploit in an affected user account...
Microsoft Windows NTFS Privileged File Access Enumeration Exploit
Microsoft Windows suffers from an NTFS privileged file access enumeration vulnerability. Attackers possessing user-only rights can gather intelligence or profile other user account activities by brute forcing a correct file name due to inconsistent error messaging. + Credits: John Page aka...
Control Web Panel 0.9.8.851 Privilege Escalation
CVE Number : CVE-2019-14721, CVE-2019-14722, CVE-2019-14723, CVE-2019-14724, CVE-2019-14725, CVE-2019-14726, CVE-2019-14727, CVE-2019-14728, CVE-2019-14729, CVE-2019-14730 Date : 24 Jul 2019 Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage :...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
CVE-2019-13517
In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account...
Design/Logic Flaw
In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account...
Unauthorised Admin User Account Creation
https://github.com/goharbor/harbor is vulnerable to unauthorized admin user account creation. During a registration of a non-admin user, a request from non-admin user to create admin user account is not validated, allowing a low-privileged user to create an admin user account...
Windows NTFS - Privileged File Access Enumeration
Windows NTFS - Privileged File Access Enumeration + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NTFS-PRIVILEGED-FILE-ACCESS-ENUMERATION.txt + ISR: ApparitionSec Vendor www.microsoft.com Product Windows...
CVE-2019-4321
CVE-2019-4321 affects IBM Intelligent Operations Center (IOC) and IBM Water Operations for Waternamics, with affected versions IOC V5.1.0–V5.2.0, IOC for Emergency Management V5.1.0–V5.1.0.6, and Waternamics V5.1.0–V5.2.1.1. The root cause is a default configuration that does not require strong p...
The vulnerability of Azure Active Directory (AAD) for managing authentication and access to Windows operating systems allows a perpetrator to gain access to a user account.
The vulnerability of Azure Active Directory AAD for managing authentication and access control on Windows operating systems is related to errors in processing MSA Managed Service Accounts cookie files. Exploiting this vulnerability could allow a malicious actor to gain access to a user account...
