CVE-2008-0940

Plain Black WebGUI is affected by a cross-site scripting (XSS) vulnerability present in versions before 7.4.24, which can allow remote attackers to inject arbitrary script or HTML when creating a username. The issue is independently identified from CVE-2007-0407. Mitigation: upgrade to WebGUI 7.4...

Design/Logic Flaw

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

CVE-2007-6487

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

CVE-2007-6487

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

CVE-2007-6487

Affected product: Plain Black WebGUI 7.4.0–7.4.17. Vulnerability arises in the admin account creation logic that allows remote authenticated users with Secondary Admin privileges to create Admin accounts (privilege escalation). No exploitation details are provided in the documents. Remediation: u...

CVE-2007-6487

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

WebGUI次管理员安全绕过漏洞

WebGUI是一款开放源代码的网站管理系统。 WebGUI不正确验证用户权限，拥有合法用户帐户信息的非特权攻击者可以利用漏洞建立管理员帐户，提升特权。 问题是次级管理Secondary Admin可建立管理员权限的用户，可导致特权提升。 WebGUI WebGUI 7.4.17 WebGUI WebGUI 7.4.16 WebGUI WebGUI 7.4.15 WebGUI WebGUI 7.4.14 WebGUI WebGUI 7.4.13 WebGUI WebGUI 7.4.12 WebGUI WebGUI 7.4.11 WebGUI WebGUI 7.4.10 WebGUI...

WebGUI < 7.4.18 Secondary Admin Remote Privilege Escalation

Binary data 4315.prm...

WebGUI < 7.3.14 viewList() Function Authentication Bypass

Binary data 4035.prm...

CVE-2007-2746

The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information, which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact...

Design/Logic Flaw

The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information, which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact...

CVE-2007-2746

The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information, which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact...

CVE-2007-2746

The CVE-2007-2746 entry concerns Plain Black WebGUI: the viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm for versions before 7.3.14 improperly uses data structures containing privilege information, enabling remote authenticated users to obtain sensitive data or potentially cause other u...

Information disclosure

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

CVE-2007-0629

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

CVE-2007-0629

CVE-2007-0629 affects Plain Black WebGUI prior to version 7.3.8, where the www_purgeList method fails to properly enforce user permissions, enabling an attacker to delete assets they should not be able to access. The vulnerability is documented in multiple sources (NVD/NVD-derived entries) and is...

CVE-2007-0629

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

WebGUI < 7.3.8 www_purgeList Method Asset Deletion

Binary data 3897.prm...

[SA23754] WebGUI User Name Script Insertion Vulnerability

TITLE: WebGUI User Name Script Insertion Vulnerability SECUNIA ADVISORY ID: SA23754 VERIFY ADVISORY: http://secunia.com/advisories/23754/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: WebGUI 7.x http://secunia.com/product/13252/ DESCRIPTION: A vulnerabili...

CVE-2007-0407

Cross-site scripting XSS vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 beta allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration, a different vector than CVE-2007-0308. NOTE: it is possible that a separate...