grub2: buffer overflow when checking password entered during bootup

A flaw was found in the way grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system...

Code injection

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

CVE-2015-5320

CVE-2015-5320 affects Jenkins and its JNLP slave mechanism. The vulnerability arises from improper verification of the shared secret used in JNLP slave connections, allowing remote attackers to connect as slaves and potentially access sensitive information or gain administrative privileges by kno...

【齐博b2b商务系统】前台多处存储型xss直打后台admin

简要描述： 来一发..... 详细说明： 齐博官网下载第一栏的最新版b2b商务系统作测试。 环境：win7+xampp php 以普通用户权限注册一个号 账号为test 目标取得后台admin权限（Cookies） 在会员中心右栏发表文章，文章发表栏任意 填完数据后提交， burp抓包，改postdbcontent栏，如图 提交。 漏洞证明： 因为默认文章需要后台审核后才能发布，用admin登陆后台审核文章。 https://images.seebug.org/upl...

ICZ MATCHA SNS Privilege Access Control Vulnerability

ICZ MATCHA SNS is a set of SNS software from ICZ Japan. A security vulnerability exists in ICZ MATCHA SNS 1.3.6 and earlier versions. A remote attacker can exploit this vulnerability to gain administrator privileges...

CVE-2015-5645

ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-4930

IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access...

Command injection

IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access...

IBM QRadar Security Information and Event Manager Unspecified Command Injection Vulnerability

IBM QRadar Security Information and Event Manager SIEM is a U.S.-based IBM solution that consolidates log-sourced event data from thousands of devices and applications dispersed throughout the network. A command injection vulnerability exists in IBM QRadar SIEM version 7.2.x and 7.1 MR2 Patch 1...

Cisco Ironport Appliances Privilege Escalation Vulnerability

Cisco Ironport Appliances Privilege Escalation Vulnerability Vendor: Cisco Product webpage: http://www.cisco.com Affected versions: Cisco Ironport ESA - AsyncOS 8.5.5-280 Cisco Ironport WSA - AsyncOS 8.0.5-075 Cisco Ironport SMA - AsyncOS 8.3.6-0 Date: 22/05/2014 Credits: Glafkos Charalambous CVE...

The vulnerability of the microprogramming software of Sierra Wireless’ wireless gateways—AirLink GX450, AirLink ES440, AirLink GX440, and AirLink LS300—allows a hacker to gain access to the device with administrator privileges.

The vulnerability of the microprogramming software in Sierra Wireless’ wireless gateways—AirLink GX450, AirLink ES440, AirLink GX440, and AirLink LS300—is related to the presence of a pre-installed user with administrator privileges. Exploiting this vulnerability allows a malicious actor to gain...

Netsweeper 4.0.8 - SQL Injection Authentication Bypass

Netsweeper 4.0.8 - SQL Injection Authentication Bypass +----------------------------------------------------------------+ + Netsweeper 4.0.8 - SQL Injection Authentication Bypass Admin + +----------------------------------------------------------------+ Affected Product: Netsweeper Vendor Homepag...

Netsweeper 4.0.8 - SQL Injection / Authentication Bypass

+----------------------------------------------------------------+ + Netsweeper 4.0.8 - SQL Injection Authentication Bypass Admin + +----------------------------------------------------------------+ Affected Product: Netsweeper Vendor Homepage : www.netsweeper.com/ Version : 4.0.8 and probably...

Mail.ru: [riot.mail.ru] Reflected XSS in debug-mode

Приветствую. Уязвимость существует за счёт отображения всех запросов к серверу в режиме отладки, доступными любому пользователю. Как следствие мы имеем 2 нехороших проблемы: 1 Full SQL Disclosure Run query: SELECT FROM forumconfig Run query: SELECT catid,name FROM forumcats ORDER BY orderid Run...

Multiple Storage-based Cross-site Scripting Vulnerabilities in Shenzhen Yifa Everlasting Yifa Cloud OA System

Yifa cloud OA office software integrates the most advanced management ideas, standardized management and value-added utilization of workflow, information flow and knowledge management to provide users with an advanced and efficient information work platform. The system is completely designed with...

foreman: edit_users permission allows changing of admin passwords

It was discovered that in Foreman the editusers permissions for example, granted to the Manager role allowed the user to edit admin user passwords. An attacker with the editusers permissions could use this flaw to access an admin user account, leading to an escalation of privileges...

Fedora 21 : php-horde-Horde-Auth-2.1.10-1.fc21 / php-horde-Horde-Core-2.20.6-1.fc21 / etc (2015-11287)

HordeForm 2.0.10 - jan SECURITY: Fixed XSS in form renderer. HordeIcalendar 2.1.1 - jan Fix generated VALARM TRIGGER attributes with empty duration Ralf Becker. HordeAuth 2.1.10 - jan SECURITY: Don't allow to login to LDAP with an emtpy password. HordeCore 2.20.6 - jan SECURITY: Don't allow to...

Shopify: Prevent Shop Admin From Seeing his Installed Apps / Install Persistent Unremovable App

Hi, This is an interesting vulnerability, when a Shopify app whose redirecturi points to a malformed URI handler like shit:google.com gets installed to a Shop then, it will effectively prevent the admins to see and remove installed apps to his/her shop. Reproduction 1. Create a Shopify App at...