1442 matches found
Code injection
On D-Link DIR-615 devices, a normal user is able to create a rootadmin user from the D-Link portal...
CVE-2019-19743
On D-Link DIR-615 devices, a normal user is able to create a rootadmin user from the D-Link portal...
Serv-U FTP Server CSV Injection Vulnerability
Serv-U is an award-winning FTP server software developed by Rob Beckers, full name: Serv-U FTP Server. FTP server users can share files on the internet through it using the FTP protocol. Serv-U FTP Server suffers from a CSV injection vulnerability that can be exploited by an attacker with the...
Design/Logic Flaw
cumin: At installation postgresql database user created without password...
CVE-2019-2233
In getUserCount and getCount of UserSwitcherController.java, there is possible new user creation due to a logic error. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is not...
CVE-2019-2233
In getUserCount and getCount of UserSwitcherController.java, there is possible new user creation due to a logic error. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is not...
WordPress WP Marketplace Remote Code Execution Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP Marketplace is an e-commerce plugin used in it. A remote code execution vulnerability exists in WordPress WP Marketplace. An attacke...
Adive Framework 2.0.7 - Privilege Escalation
Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Date: 2019-08-02 Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE : CVE-2019-14347 Exploit import requests import...
Adive Framework 2.0.7 Privilege Escalation
Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Date: 2019-08-02 Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE : CVE-2019-14347 Exploit import requests import...
Adive Framework 2.0.7 - Privilege Escalation
Adive Framework 2.0.7 - Privilege Escalation Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Date: 2019-08-02 Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE :...
ownCloud 10.3.0 stable - Cross-Site Request Forgery
Exploit Title: ownCloud 10.3.0 stable - Cross-Site Request Forgery Date: 2019-10-31 Exploit Author: Ozer Goker Vendor Homepage: https://owncloud.org Software Link: https://owncloud.org/download/ Version: 10.3 CVE: N/A Introduction Your personal cloud collaboration platform With over 50 million...
Qualys Cloud Platform 8.21.6 New Features
Update Nov 19, 2019: This blog post was updated with additional detail about the new features in 8.21.6. The 8.21.6 release adds several new features in Qualys Cloud Platform, Policy Compliance, and Vulnerability Management. Apart from various other new features, this release adds support for App...
CVE-2019-12147
The Sangoma Session Border Controller SBC 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to th...
Sangoma SBC 2.3.23-119-GA Authentication Bypass Vulnerability
A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to bypass authentication and login as a non-existent user but with complete access to the dashboard including additional privileged user creation capabilities...
Sangoma Technologies SBC Parameter Injection Vulnerability
The Sangoma Technologies SBC is a border session controller SBC from Sangoma Technologies, a Canadian company. A parameter injection vulnerability exists in Sangoma Technologies SBC version 2.3.23-119-GA, which can be exploited by an attacker to bypass authentication and log in as a non-existing...
Sangoma SBC 2.3.23-119-GA Unauthenticated User Creation
Introduction Description A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to create a privileged user on the system using the web application login interface. Vulnerability Type - Argument Injection or Modification...
Fedora 30 : phpMyAdmin (2019-6404181bf9)
Upstream announcement : Welcome to phpMyAdmin 4.9.1, a bugfix release. This is a regularly-schedule bugfix release that also includes some security hardening measures. We wish to point out that this also includes a routine fix for an issue that has been reported as CVE-2019-12922. The fix for thi...
DRUPAL-CONTRIB-2019-066
This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's setting for "Who can register accounts?" when set to "Visitors, but administrator approval is required". When this option is chosen, the module overrides the setting, and makes it...