CVE-2022-26375

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology AB Press Optimizer plugin = 1.1.1 on WordPress...

PT-2022-26325 · Unknown · Merchandise Online Store

Name of the Vulnerable Software and Affected Versions: Merchandise Online Store version 1.0 Description: A SQL Injection issue allows an attacker to log in to the admin account. Recommendations: For Merchandise Online Store version 1.0, consider temporarily restricting access to the admin login...

Exploit for CVE-2021-44103

CVE-2021-44103 A proof of concept for KONGA 0.14.9 - Privilege...

CVE-2022-41436

An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://deviceip/index1.html...

GitHub: Github app Privilege Escalation to Administrator/Owner of the Organization

Vulnerability description not provided...

CVE-2022-41643

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Accessibility plugin = 1.0.3 on WordPress...

Using ifAdmin modifier to forcefully interact with implementation contracts via _fallback() call.

Lines of code Vulnerability details Impact The modifier ifAdmin allows internal delegation to the implementation contract if caller is not admin by calling the fallback function which delegates the current call to implementation. This allows a user who is not admin to call to make a transaction...

Dell EMC XtremIO 安全漏洞

Dell EMC XtremIO is an all-flash, horizontally scalable enterprise storage array from Dell, Inc. A brute force vulnerability exists in Dell EMC XtremIO X2 versions prior to 6.4.0-22, which can be exploited by an unauthenticated, remote attacker to gain access to the administrator account...

CVE-2022-2981

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2554

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example...

CVE-2022-2448

The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

Design/Logic Flaw

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

CVE-2022-2975

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0...

PT-2022-6310 · Ibm · Ibm Cloud Pak For Multicloud Management Monitoring

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management Monitoring versions 2.0 through 2.3 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to elevate...

PT-2022-5017 · Vmware · Vcenter Server +1

Name of the Vulnerable Software and Affected Versions: vCenter Server affected versions not specified Description: The vCenter Server contains an unsafe deserialization vulnerability in the PSC Platform services controller. A malicious actor with admin access on the vCenter server may exploit thi...

CVE-2022-2628

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-34428

Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service...