1815 matches found
Concrete CMS: Stored XSS in Name field in User Groups/Group Details form
Intro "The Crayons of Madagascar" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. 32c9daf352645d4fafedb7b956e7f2de4e153ab3 Summary There is Stored XSS vulnerability in User Groups-Group Details Name field. This vulnerability might be used ...
"XenDesktop Site is not reachable, check that the Citrix PVS Soap Server service user has XenDesktop permissions and network connectivity" While Promoting vDisk Version
The following error appears while trying to promote an updated version of a vDisk: "XenDesktop Site f0a65a14-f50b-403a-ba3b-77700c7829b7 is not reachable, check that the Citrix PVS Soap Server service user has XenDesktop permissions and network connectivity." The PVS Soap Server service runs as...
CVE-2017-8907
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this...
PermissionHelper is sending incorrect data
h3 summary Permissionhelper didn't send right results for user who should be able to change permissions h3.Environment Confluence 6.1.3 h3. Steps to reproduce 1. Create a group in Active Directory named "app-confluence-space-keyuser", and add some users i.e "test" 2. Create a group in Active...
Vulnerability of the Framework API of the Android operating system, which allows a hacker to gain access to user permissions
The vulnerability of the Framework API of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges and gain access to user permissions through a local malware application...
SUSE-SU-2017:1349-1 Security update for SUSE Manager Server 3.0
The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. bsc1026633, CVE-2017-7470 Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib...
SUSE-SU-2017:1346-1 Security update for SUSE Manager Proxy 3.0
The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. bsc1026633, CVE-2017-7470 Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib...
SUSE-SU-2017:1352-1 Security update for SUSE Manager Client Tools
The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. bsc1026633, CVE-2017-7470 Additionally, the following non-security issues have been fixed: cobbler: - Support UEFI boot with cobbler...
Dropbear -- two vulnerabilities
Matt Johnston reports: Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a Allow connections to forwarded ports from any host This could potentially allow arbitrary code execution as root by an...
CVE-2016-3067
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges...
File Overwrite
passenger is vulnerable to a file overwrite. A malicious user can create a symlink to the /tmp/passenger-check.c file, attempting to overwrite the chosen file by running passenger-install-nginx-module. The overwriting attempt would run with the same user permissions as the user running...
Microsoft Windows Hyper-V CVE-2017-0162 Remote Code Execution Vulnerability
Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits allow attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial of service condition. Technologies Affected Microsoft Window...
Code injection
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...
CVE-2016-8355
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and...
Code injection
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and...
CVE-2016-8355
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and...
CVE-2016-8355
The CVE-2016-8355 entry documents an elevation-of-privilege flaw in Smiths-Medical CADD-Solis Medication Safety Software (versions 1.0–3.1). An authenticated user can gain elevated privileges on the embedded SQL database, enabling modification of drug libraries, user management (add/delete users)...
CVE-2016-8355
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and...
New Relic: Restricted user is able to delete filter sets of admin users in https://infrastructure.newrelic.com/accounts/{{ACC#}}/settings/filterSets
At this endpoint: https://infrastructure.newrelic.com/accounts/████/settings/filterSets the application does not properly check to ensure that a user with restricted settings is able to delete filters of other users, including a filter of an admin. Step by step instructions 1. Admin creates a New...