CVE-2020-24673

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the database such as shutdown the DBMS, recover the content of a given file present on the DBMS file...

ABB Symphony Plus Operations and ABB Symphony Plus Historian SQL Injection Vulnerabilities

ABB Symphony Plus Operations and ABB Symphony Plus Historian are both products of ABB Switzerland.ABB Symphony Plus Operations is a management device used in industrial environments to improve operational efficiency. The device provides an easy-to-use human-machine interface that seamlessly...

The vulnerability of the Junos operating system arises from the lack of measures taken to protect the web page structure. This allows attackers to intercept the HTTP/HTTPS session of the target user and perform administrative actions.

The vulnerability of the Junos operating system exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to capture the HTTP/HTTPS session of the target user and perform administrative actions...

EPSON EPS TSE Server Cross-Site Request Forgery Vulnerability

EPSON EPS TSE Server is a server from EPSON Japan. EPSON EPS TSE Server 8 suffers from a cross-site request forgery vulnerability that stems from a lack of anti-csrf tokens throughout the administration interface, allowing an unauthenticated attacker to exploit the vulnerability by visiting a...

SAP Solution Manager Authorization Issues Vulnerability (CNVD-2020-70951)

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

SAP Solution Manager 安全漏洞

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

Fastweb FASTGate Cross-Site Request Forgery Vulnerability (CNVD-2020-67310)

Fastweb FASTGate is a modem from Fastweb Italy. A cross-site request forgery vulnerability exists in Fastweb FASTGate GPON FGA2130FWB version 2020-05-26 and prior versions that allows CSRF to manage web panels through the router, which could be exploited by an attacker to be able to perform...

Fastweb FASTGate 跨站请求伪造漏洞

Fastweb FASTGate is a modem from Fastweb Italy. A cross-site request forgery vulnerability exists in Fastweb FASTGate GPON FGA2130FWB version 2020-05-26 and prior versions that allows CSRF to manage web panels through the router, which could be exploited by an attacker to be able to perform...

Red Hat CloudForms Security Vulnerability

Red Hat CloudForms is a hybrid infrastructure management platform from Red Hat, Inc. The platform provides users with deployment, management, and other capabilities across virtual machines, clouds, containers, and physical infrastructure. Cloudforms has a security vulnerability that can be...

CVE-2020-1673

Insufficient Cross-Site Scripting XSS protection in Juniper Networks J-Web and web based HTTP/HTTPS services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Junip...

Ozeki NG SMS Gateway Cross-Site Request Forgery Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A cross-site request forgery vulnerability exists in Ozeki NG SMS Gateway 4.17.6 and earlier versions. An attacker can use this vulnerability to trick an administrator into installing a new module or changing a...

CVE-2020-4611

IBM Data Risk Manager iDNA 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922...

CVE-2020-4611

IBM Data Risk Manager iDNA 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922...

CVE-2020-4611

IBM Data Risk Manager (iDNA) 2.0.6 is reported to allow an authenticated user to bypass security and perform actions reserved for admins. The entry notes this as a vulnerability in the product, with IBM’s remediation path recommending upgrading to v2.0.6.4 and then applying subsequent fixpacks (2...

CVE-2020-10229

A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and deleting accounts...

CVE-2020-2036

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...

CVE-2020-20627

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change...

CVE-2020-20627

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change...

PT-2020-15274

Name of the Vulnerable Software and Affected Versions GiveWP plugin versions prior to 2.5.10 Description The issue allows unauthenticated changes to settings. This is due to a problem in the includes/gateways/stripe/includes/admin/admin-actions.php file. Recommendations For GiveWP plugin versions...

CloudForms: Missing access control leads to escalation of admin group privileges

A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes...