Cisco UCS Director Privilege Escalation Vulnerability

A vulnerability in the web-based GUI of Cisco UCS Director could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrig...

CVE-2017-3801

A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control RBAC...

Cisco UCS Director Privilege Escalation Vulnerability

A vulnerability in the web-based GUI of Cisco UCS Director could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile. The vulnerability is due to improper role-based access control RBAC after the Developer Menu is enabled in Cisco UCS Director...

Finance Website Script SQL Injection

Vulnerability: SQL Injection Date: 18.01.2017 Vendor Homepage: http://www.scriptgiant.com/ Script Name: Finance Website Script Script Buy Now: http://www.popularclones.com/products/Finance-Website-Script Author: Ihsan Sencan Author Web: http://ihsan.net Mail : ihsanbeygirihsannoktanet SQL...

Blackboard LMS 9.1 SP14 - (Profile) Persistent Vulnerability

Document Title: =============== Blackboard LMS 9.1 SP14 - Profile Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1900 Release Date: ============= 2017-01-09 Vulnerability Laboratory ID VL-ID: ====================================...

Blackboard LMS 9.1 SP14 - (Profile) Persistent Vulnerability

Document Title: =============== Blackboard LMS 9.1 SP14 - Profile Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1900 Release Date: ============= 2017-01-09 Vulnerability Laboratory ID VL-ID: ====================================...

Description of Windows Small Business Server 2008 Update Rollup 6

Description of Windows Small Business Server 2008 Update Rollup 6 Summary Windows Small Business Server Windows SBS 2008 Update Rollup 6 is now available. This update addresses the following issues that were not previously documented in a Microsoft Knowledge Base KB article. Issue 1 A computer th...

oxfam.org.au XSS vulnerability

Vulnerable URL: https://www.oxfam.org.au/my/profile/gettheuser?jsoncallback=prompt/OPENBUGBOUNTY/...

User Management - Space View and Edit Control

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-45194. panel With our Confluence users linking to LDAP, it is difficult having to create and delete groups to control permission...

User Management - Space View and Edit Control

With our Confluence users linking to LDAP, it is difficult having to create and delete groups to control permissions. Whilst it is great having permission controls for each space, this can be a nightmare going through each one to control individual users and having a list the length of my arm to...

UPM Failing for account with error "The specified account does not exist."

Users not receiving a UPM profile when logging into application. When logging in UPM fails, within the UPM logs we only see the following logged :- 2016-08-25;14:11:45.659;INFORMATION;EXTRANET;x9027690;3;15276;CADUser::Init: Determined user and DNS domain name: ,...

User Profile name changes from User Name to "My Documents" or "Documents"

Under certain circumstances, the Desktop.ini file may cause the User Profile folder name on the User Store to change from the User Name to "My Documents". If we delete the "desktop.ini" file in the "My Documents" folder, it changes the folder name back to the correct user name...

Profiles Are Not Written Back to User Store on Logoff

Under certain circumstances User Profiles are not written back to the UPM User Store during log off...

DNN (DotNetNuke) < 8.0.1 XSS Vulnerability

DNN formerly DotNetNuke is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Shopify: Deleted Post and Administrative Function Access in eCommerce Forum

Hi, I initially queried the following report as a comment in 165048, in which @juanbroullon confirmed the issue appeared valid and requested I open a new Shopify report. A selection of privileged information is provided upon appending /edit to a user profile URL on the eCommerce forum as an...

CVE-2016-6211

Removed by vendor...

Yelp: IDOR(indirect object references) on add friend,complement and send message

Hi security , Description: I found user id in encrypted form from there profile url https://www.yelp.com/userdetails?userid= on intercepting request of add friend, complement and send message i can identify user id .. when i change identified user ID to other user's ID then request of add friend ...

DotNetNuke cross-site scripting vulnerability (CNVD-2016-07083)

DotNetNuke DNN is a set of U.S. DNN company supported by Microsoft , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. A cross-site scripting vulnerability exists in the user-profile profile area in DNN...

Legal Robot: Validation bypass on user profile

A security researcher discovered that form validations for fields like first name, last name, and job title could be bypassed while editing a user profile...

GitLab - impersonate Feature Privilege Escalation

GitLab - impersonate Feature Privilege Escalation Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website...