6457 matches found
CVE-2023-27313
This CVE affects NetApp SnapCenter. A vulnerability exists in SnapCenter versions 3.x and 4.x prior to 4.9 that may allow an authenticated unprivileged user to gain administrative access. The issue is demonstrated across multiple sources and is characterized as a privilege-escalation risk (authen...
SB Child List <= 4.5 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
PT-2023-21061 · Netapp · Snapcenter
Name of the Vulnerable Software and Affected Versions: SnapCenter versions 3.x and 4.x prior to 4.9 Description: The issue may allow an authenticated unprivileged user to gain access as an admin user. Recommendations: For SnapCenter versions 3.x and 4.x prior to 4.9, update to version 4.9 or late...
F5 BIG-IP iControl Security Bypass Vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A security bypass vulnerability exists in F5 BIG-IP iControl, which can be exploited by an attacker to allow a...
kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()
An out-of-bounds OOB memory access flaw was found in the Netfilter module in the Linux kernel's nftbyteordereval in net/netfilter/nftbyteorder.c. A bound check failure allows a local attacker with CAPNETADMIN access to cause a local privilege escalation issue due to incorrect data alignment...
CVE-2023-42768
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...
CVE-2023-42768
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...
Sangfor Next-Gen Application Firewall Security Vulnerabilities
Sangfor Next-Gen Application Firewall Sangfor NGAF is an application firewall from China-based Sangfor. A security vulnerability exists in Sangfor Next-Gen Application Firewall NGAF version 8.0.17, which exploits a vulnerability that could allow an unauthenticated attacker to bypass authenticatio...
CVE-2023-45355
Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as...
Table of Contents Plus < 2309 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2023-44766
Concrete CMS v9.2.1 contains a Cross-Site Scripting (XSS) vulnerability in the SEO-Extra feature, specifically within the Header and Footer Tracking Codes component. The issue stems from insufficient filtering/escaping of user-supplied data, allowing an attacker to inject and execute arbitrary sc...
Stored Cross Site Scripting (XSS)
Description The location endpoint is not sanitized which leads to the Stored Cross Site Scripting XSS Proof of Concept 1. Login as a standard user non-admin Asset page List All https://drive.google.com/file/d/1qymhc6sMe9EeS2bOe4CE2XTAbzFkgHao/view?usp=drivelink 2. Click to open any asset Edit Ass...
Newsletter Lite < 4.9.3 - Admin+ Command Injection
Description The plugin does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server. PoC 1 Navigate to "Newsletters Configuration History & Emails Configuration"...
CVE-2023-0506
The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access...
CVE-2023-36628
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation...
CVE-2023-44265
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Popup contact form plugin = 7.1 versions...
CVE-2023-44262
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Renzo Johnson Blocks plugin = 1.6.41 versions...
CVE-2023-44263
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Riyaz Social Metrics plugin = 2.2 versions...