CVE-2019-15089

An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator...

CVE-2019-1938

A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is...

Multiple vulnerabilities in WordPress Plugin "Attendance Manager"

Overview WordPress Plugin "Attendance Manager" provided by SUKIMALAB.COM contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2019-5970 Cross-site request forgery vulnerability CWE-352 - CVE-2019-5971 Natsumi Matsuoka of Cryptography...

CVE-2018-10696

An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her...

WordPress plugin "Smart Forms" vulnerable to cross-site request forgery

Overview The WordPress plugin "Smart Forms" provided by RedNao contains a cross-site request forgery vulnerability CWE-352. Masaki Saito of TDU Cryptography Lab. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...

The vulnerability of the OpenNMS monitoring system, a network management platform from Juniper Networks Junos Space, arises due to insufficient protection of the website structure. This allows attackers to disclose protected information or perform actions on behalf of the administrator.

The vulnerability of OpenNMS, which is included in the Juniper Networks Junos Space network management platform, stems from insufficient protection of the website structure. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or carry out actions on behalf ...

Design/Logic Flaw

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...

Aplaya Beach Resort Online Reservation System 1.0 - SQL Injection / Cross-Site Request Forgery

Exploit Title: Aplaya Beach Resort Online Reservation System 1.0 - Multiple Vulnerabilities Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

BlackBerry UEM Management Console Information Disclosure Vulnerability

BlackBerry UEM is a unified endpoint management solution from BlackBerry Canada. The solution is used to manage endpoint devices and view their access.Management Console is one of the management console programs. An information disclosure vulnerability exists in Management Console in BlackBerry U...

TP-Link TL-WR841N and TL-WR841ND Cross-Site Request Forgery Vulnerability

The TP-Link TL-WR841N and TL-WR841ND are both wireless router devices. TP-Link TL-WR841N and TL-WR841ND cross-site request forgery vulnerability. An attacker could use this vulnerability to perform certain administrator actions and gain unauthorized access to affected applications, and other...

CVE-2018-1000512

Tooltipy Tooltipy tooltips for WP version 5 contains a Cross Site Scripting XSS vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been...

CVE-2018-1000508

WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

TIBCO Administrator - Enterprise Edition TIBCO Administrator server component cross-site scripting vulnerability

TIBCO Administrator is an application for deploying TIBCO products from TIBCO Software, USA. The program supports deploying TIBCO products, managing users, monitoring hosts, etc. TIBCO Administrator-Enterprise Edition is its enterprise edition.TIBCO Administrator server is one of the management...

Siemens TIM 1531 IRC Security Bypass Vulnerability

The Siemens TIM 1531 IRC is a communication module from Siemens that handles data transfer using the Siemens remote control protocol SINAUT ST7. A security vulnerability exists in the Siemens TIM 1531 IRC prior to version 1.1. A remote attacker could use this vulnerability to perform administrati...

PT-2018-18161 · Otrs +2 · Otrs +2

Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 5.0.0 through 5.0.24 Open Ticket Request System OTRS versions 6.0.0 through 6.0.1 Description: The issue allows authenticated admins to exploit a Blind Remote Code Execution vulnerability by loading a...

IBM Security Guardium Database Activity Monitor Authorization Vulnerability

IBM Security Guardium Database Activity Monitor is a database activity monitor product from IBM USA. The product provides features such as automated controls for compliance and protection against internal and external threats. An authorization vulnerability exists in IBM Security Guardium Databas...

CVE-2018-1368

IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions that only an admin should be performing, so there is risk that someone not authorized can change things that they are not suppose to. IBM...

Siemens TeleControl Server Basic Elevation of Privilege Vulnerability

Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens, Germany. A security vulnerability exists in Siemens TeleControl Server Basic versions prior to 3.1. An attacker could use this vulnerability to elevate privileges and perform administrative operations...