116 matches found
Incorrect Authorization in Apache Ozone
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins...
CVE-2021-39232
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins...
CVE-2021-39232
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins...
Design/Logic Flaw
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins...
CVE-2021-39232
Apache Ozone (versions prior to 1.2.0) is affected by an authorization issue where certain admin SCM commands can be executed by any authenticated user, effectively an authorization bypass. The vulnerability is described across multiple sources (NVD, Red Hat, OSV, GHSA, CNVD, Veracode) with the c...
Apache Ozone 安全漏洞
Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. a security vulnerability in Apache Ozone version 1.2.0, which stems from the fact that certain administrator-related SCM commands can be executed by any authenticated user...
CVE-2021-3291
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...
CVE-2020-3144
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary commands...
CVE-2020-10038
A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the device's web server might be able to execute administrative commands without authentication...
PrestaShop Authorization Issues Vulnerability
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. PrestaShop suffers from an authorization issue vulnerability that originates from an...
CVE-2020-4074
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...
Authentication flaw
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...
PT-2020-17863 · Prestashop · Prestashop
Name of the Vulnerable Software and Affected Versions: PrestaShop versions 1.5.0.0 through 1.7.6.6 PrestaShop versions 1.5.0.0 through 1.7.7.6 is not used because 1.7.6.6 is the fixed version mentioned in the NVD source which has higher priority than Telegram. Description: The authentication syst...
CVE-2020-3229
A vulnerability in Role Based Access Control RBAC functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administrati...
Siemens SiNVR 3 SQL Injection Vulnerability
SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 has a SQL injection vulnerability in the XML-based communication protocol by default, which can be exploited by remote attackers to read or modify the...
PT-2020-2444 · Unknown · Control Center Server
Name of the Vulnerable Software and Affected Versions: Control Center Server versions prior to V1.5.0 Description: The issue is related to a lack of protection against SQL query structure exploitation. This can be exploited by a remote attacker to read or modify the central control server databas...
DEBIAN-CVE-2019-10784
phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to vis...
Cross-site Request Forgery (CSRF)
Overview phppgadmin/phppgadmin is a web-based administration tool for PostgreSQL. It is perfect for PostgreSQL DBAs, newbies, and hosting services. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. Multiple areas within the application allows sensitive actions t...
Multiple vulnerabilities in WordPress Plugin "wpDataTables Lite"
Overview WordPress Plugin "wpDataTables Lite" provided by TMS-Plugins contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6011 SQL Injection CWE-89 - CVE-2019-6012 Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to the developer and...