First things first: Envisioning your security deployment

This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

Design/Logic Flaw

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before version 1.6.4 is vulnerable to an admin authentication bypass that allows an attacker to gain admin access. The issue is documented across multiple sources (NVD, Nuclei template, SUSE, CNVD, OSV, etc.) with the root cause described as an admin-privilege bypass affecting Ether...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-10519

CMS Made Simple CMSMS 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE$this-loginkey to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because o...

Stellar.org: brute force attack allowed on admin page https://www.stellar.org/wp-admin/

hi security team -due to your bug bounty program , i found basic authentication method -by doing many trials the server will response and will not block the logging process - the attack can be automated by burp intruder till getting access to admin page - in second screen the request is intercept...

VK.com: Часть админки доступна для всех пользователей

Раскрытие старого админ. интерфейса...

CVE-2017-2871

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CMS Made Simple Elevation of Privilege Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS 2.2.6 and...

Cybozu Garoon Operation Limit Bypass Vulnerability

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. An operation restriction bypass vulnerability exists in "Folder Settings" in Cybozu Garoon 3.0.0 through 4.2.6. The vulnerability can be exploited by a user with administrative privileges for one or more folders to...

The vulnerability of the Promontory chip, which is used together with Ryzen and Ryzen Pro processors, is related to the presence of undeclared capabilities in its microprogramming software. This vulnerability allows access to physical memory.

The vulnerability of the Promontory chip, which is used together with Ryzen and Ryzen Pro processors, is related to the presence of undeclared capabilities in its microprogramming environment. Exploiting this vulnerability allows a perpetrator who has access to the targeted computer and possesses...

Open-AuditIT Professional 2.1 - Cross-Site Request Forgery

Open-AuditIT Professional 2.1 - Cross-Site Request Forgery Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery CSRF Date: 27-03-2018 Exploit Author: Nilesh Sapariya Contact: https://twitter.com/nileshloganx Website: https://nileshsapariya.blogspot.com Vendor Homepage:...

CVE-2018-4841

A vulnerability has been identified in TIM 1531 IRC All versions V1.1. A remote attacker with network access to port 80/tcp or port 443/tcp could perform administrative operations on the device without prior authentication. Successful exploitation could allow to cause a denial-of-service, or read...

Cross-site Scripting Vulnerability in Qibo Website Building System v7.0

Qibo CMS is a multifunctional modular website management system that combines articles, downloads, pictures, classifieds, videos, shopping malls, music, blogs, talents, Q&A and other modules. Qibo CMS v7.0 suffers from a cross-site scripting vulnerability, which is caused by the system not...