CVE-2019-15747

CVE-2019-15747 affects SITOS six Build v6.2.1. A user with the Seminar Coordinator role can escalate to System Administrator due to insufficient server-side access checks, enabling privilege escalation. CVSS data in the records shows a high impact (CVSS‑3.1 base score 8.8) but no exploit details ...

CVE-2019-15747

SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side...

WordPress user-role plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. user-role is a plug-in for website user management. A cross-site scripting vulnerability exists in the WordPress user-role plugin...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

Cross site scripting

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The CVE-2017-18566 affects the WordPress plugin “user-role” by BestWebSoft, specifically versions before 1.5.6. The connected data confirms multiple XSS vulnerabilities (CWE-79) in this plugin, with practical impact: authenticated attackers can inject and execute arbitrary JavaScript in victims’ ...

CVE-2019-1010034

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...

File Manager < 5.2 - Multiple Vulnerabilities

Multiple vulnerabilities exist due to not checking the authentication of the user properly in the wpajax action calls. This results in SQL injection, backup download, backup deletion and backup restoration in the backup feature of the plugin. Authentication is required, but this can be of any use...

Convert Plus Plugin for WordPress < 3.4.3 Arbitrary User Role Creation

The WordPress Convert Plus Plugin installed on the remote host is affected by an unauthenticated arbitrary user role creation vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress ConvertPlus plugin <= 3.4.2 - Unauthenticated Arbitrary User Role Creation vulnerability

Unauthenticated Arbitrary User Role Creation vulnerability found by WordFence in WordPress ConvertPlus plugin versions = 3.4.2. Solution Update the WordPress ConvertPlus plugin to the latest available version at least 3.4.3...

ConvertPlus <= 3.4.2 - Unauthenticated Arbitrary User Role Creation

The convertplug WordPress plugin was affected by an Unauthenticated Arbitrary User Role Creation security vulnerability...

CVE-2019-6617

CVE-2019-6617 describes a privilege-assignment flaw in F5 BIG-IP where a Resource Administrator can overwrite sensitive low-level files (e.g., /etc/passwd) via SFTP without Advanced Shell access. Affected BIG-IP versions include 11.5.2–11.5.8, 11.6.1–11.6.3.4, 12.1.0–12.1.4, 13.0.0–13.1.1.4, and ...

Authorization Bypass

CFME is vulnerable to authorization bypass. User role permissions for actions associated with catalogs are not properly validated, which would allow an authenticated Management Engine user to use this flaw to delete arbitrary catalogs regardless of the granted permissions...

Remote code execution

In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to...

Authorization

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119...

TufinOS 2.17 Build 1193 - XML External Entity Injection Vulnerability

Exploit for linux platform in category web applications Exploit Title: TufinOS 2.17 Build 1193 - XML External Entity Injection Exploit Author: konstantinos Alexiou Vendor: https://www.tufin.com Software Link: https://www.tufin.com/tufin-orchestration-suite/securetrack CVE: N/A Category: webapps 1...

OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Admin)

OOP CMS BLOG 1.0 - Cross-Site Request Forgery Add Admin Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-11-06 Exploit Author: Ihsan Sencan Vendor Homepage: http://zsoft.com.bd/ Software Link:...

GHSA-9Q2P-FJ49-VPXJ In marshmallow library the schema "only" option treats an empty list as implying no "only" option

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields if the schema is being filtered dynamically using the...