CVE-2016-2243

Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service BIOS recovery failure by leveraging administrative access...

jenkins: API tokens of other users available to admins (SECURITY-200)

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user...

PT-2016-1104

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 5.0.0 through 5.0.11 FortiAnalyzer versions 5.2.x prior to 5.2.5 FortiSwitch versions 3.3.x prior to 3.3.3 FortiCache versions 3.0.x prior to 3.0.8 FortiOS versions 4.1.x prior to 4.1.11 FortiOS versions 4.2.x prior to...

CVE-2015-6020

ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account...

Guangzhou Shengqi Computer Information Technology Co., Ltd.'s Administrative Asset Management System Has a java Deserialization Vulnerability

Guangzhou Shengqi computer information technology limited company provides software products and technical services. Guangzhou Shengqi Computer Information Technology Co., Ltd. administrative utility asset management system java deserialization vulnerability, an attacker using the relevant tools,...

CVE-2015-7911

Saia Burgess PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, and PCD7.D4xxxT5F devices before 1.24.50 and PCD3.T665 and PCD3.T666 devices before 1.24.41 have hardcoded credentials, which allows remote attackers to obtain administrative access via...

PT-2015-2867

Name of the Vulnerable Software and Affected Versions Juniper ScreenOS versions 6.2.0r15 through 6.2.0r18 Juniper ScreenOS versions 6.3.0r12 before 6.3.0r12b Juniper ScreenOS versions 6.3.0r13 before 6.3.0r13b Juniper ScreenOS versions 6.3.0r14 before 6.3.0r14b Juniper ScreenOS versions 6.3.0r15...

WordPress Google Adsense 1.29 Cross Site Scripting Vulnerability

WordPress Google Adsense plugin version 1.29 suffers from a cross site scripting vulnerability. WordPress Google Adsense 1.29 Cross Site Scripting Vulnerability Plugin Name : Google Adsense Effected Version : 1.29 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XS...

WordPress Google Captcha 1.05 Cross Site Scripting

Plugin Name : Google Captcha reCAPTCHA Effected Version : 1.05 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the...

grub2: buffer overflow when checking password entered during bootup

A flaw was found in the way grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system...

Code injection

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

CVE-2015-5320

CVE-2015-5320 affects Jenkins and its JNLP slave mechanism. The vulnerability arises from improper verification of the shared secret used in JNLP slave connections, allowing remote attackers to connect as slaves and potentially access sensitive information or gain administrative privileges by kno...

【齐博b2b商务系统】前台多处存储型xss直打后台admin

简要描述： 来一发..... 详细说明： 齐博官网下载第一栏的最新版b2b商务系统作测试。 环境：win7+xampp php 以普通用户权限注册一个号 账号为test 目标取得后台admin权限（Cookies） 在会员中心右栏发表文章，文章发表栏任意 填完数据后提交， burp抓包，改postdbcontent栏，如图 提交。 漏洞证明： 因为默认文章需要后台审核后才能发布，用admin登陆后台审核文章。 https://images.seebug.org/upl...

ICZ MATCHA SNS Privilege Access Control Vulnerability

ICZ MATCHA SNS is a set of SNS software from ICZ Japan. A security vulnerability exists in ICZ MATCHA SNS 1.3.6 and earlier versions. A remote attacker can exploit this vulnerability to gain administrator privileges...

CVE-2015-5645

ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-4930

IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access...

Command injection

IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access...

IBM QRadar Security Information and Event Manager Unspecified Command Injection Vulnerability

IBM QRadar Security Information and Event Manager SIEM is a U.S.-based IBM solution that consolidates log-sourced event data from thousands of devices and applications dispersed throughout the network. A command injection vulnerability exists in IBM QRadar SIEM version 7.2.x and 7.1 MR2 Patch 1...