UTStar WA3002G4 Authentication Bypass Vulnerability

The UTStar WA3002G4 is a modem from UTStarcom USA. An authentication bypass vulnerability exists in the UTStar WA3002G4. An attacker can use this vulnerability to directly access administrator settings and obtain plaintext credentials from the HTML source...

Schneider Electric MGE UPS and MGE STS 66074 MGE Network Management Card Transverse Sensitive Information Vulnerability (CNVD-2018-11132)

The Schneider Electric MGE UPS and MGE STS are both products of the French company Schneider Electric.The Schneider Electric MGE UPS is an uninterruptible power supply unit.The MGE STS is a static toggle switch.66074 MGE Network Management Card Transverse is one of the network management cards...

TP-Link EAP Controller and Omada Controller Elevation of Privilege Vulnerability

TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A security vulnerability exists in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows, which originates from the program's...

First things first: Envisioning your security deployment

This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

Design/Logic Flaw

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before version 1.6.4 is vulnerable to an admin authentication bypass that allows an attacker to gain admin access. The issue is documented across multiple sources (NVD, Nuclei template, SUSE, CNVD, OSV, etc.) with the root cause described as an admin-privilege bypass affecting Ether...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-10519

CMS Made Simple CMSMS 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE$this-loginkey to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because o...

Stellar.org: brute force attack allowed on admin page https://www.stellar.org/wp-admin/

hi security team -due to your bug bounty program , i found basic authentication method -by doing many trials the server will response and will not block the logging process - the attack can be automated by burp intruder till getting access to admin page - in second screen the request is intercept...

VK.com: Часть админки доступна для всех пользователей

Раскрытие старого админ. интерфейса...

CVE-2017-2871

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CMS Made Simple Elevation of Privilege Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS 2.2.6 and...

Cybozu Garoon Operation Limit Bypass Vulnerability

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. An operation restriction bypass vulnerability exists in "Folder Settings" in Cybozu Garoon 3.0.0 through 4.2.6. The vulnerability can be exploited by a user with administrative privileges for one or more folders to...

The vulnerability of the Promontory chip, which is used together with Ryzen and Ryzen Pro processors, is related to the presence of undeclared capabilities in its microprogramming software. This vulnerability allows access to physical memory.

The vulnerability of the Promontory chip, which is used together with Ryzen and Ryzen Pro processors, is related to the presence of undeclared capabilities in its microprogramming environment. Exploiting this vulnerability allows a perpetrator who has access to the targeted computer and possesses...