CVE-2020-24029

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated...

CVE-2020-8607

An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or...

CVE-2020-6239

Under certain conditions SAP Business One Backup service, versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure...

Information disclosure

Under certain conditions SAP Business One Backup service, versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure...

CVE-2020-6239

Under certain conditions SAP Business One Backup service, versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure...

CVE-2020-6239

CVE-2020-6239: SAP Business One Backup service (versions 9.3 and 10.0) is vulnerable to information disclosure. Under certain conditions, an attacker with admin permissions can view the SYSTEM user password in clear text, exposing credential data. The affected component is the SAP Business One Ba...

CVE-2020-6239: Insufficiently Protected Credentials

Under certain conditions SAP Business One Backup service, versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure...

PT-2020-19035

Name of the Vulnerable Software and Affected Versions SAP Business One versions 9.3, 10.0 Description The issue allows an attacker with admin permissions to view the SYSTEM user password in clear text under certain conditions, leading to information disclosure. Recommendations For versions 9.3 an...

CVE-2019-19937

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."...

Kubernetes: Grafana Improper authorization

Summary: new report from part2. wrong configuration causes Grafana datasource to use root userwith influxdb admin priv. Component Version: test-infra:master Steps To Reproduce: in normally configuration read-only user used by grafana, but in my test i found datasource user wite admin perms. refer...

DEBIAN-CVE-2019-19118

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...

Total.js CMS 12 - Widget JavaScript Code Injection Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Total.js CMS 12 Widget JavaScript Code Injection', 'Description' = %q This module exploits a vulnerability in Total.js CMS. The issue is that a...

Atlassian Bitbucket 5.14.x < 5.14.4 Path Traversal Vulnerability

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is 5.13.x prior to 5.13.6, 5.14.x prior to 5.14.4, 5.15.x prior to 5.15.3, 5.16.x prior to 5.16.3, 6.0.x prior to 6.0.3 or 6.1.x prior to 6.1.2. It is, therefore, affected by a path...

Atlassian Bitbucket 5.15.x < 5.15.3 Path Traversal Vulnerability

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is 5.13.x prior to 5.13.6, 5.14.x prior to 5.14.4, 5.15.x prior to 5.15.3, 5.16.x prior to 5.16.3, 6.0.x prior to 6.0.3 or 6.1.x prior to 6.1.2. It is, therefore, affected by a path...

Atlassian Bitbucket 6.0.x < 6.0.3 Path Traversal Vulnerability

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is 5.13.x prior to 5.13.6, 5.14.x prior to 5.14.4, 5.15.x prior to 5.15.3, 5.16.x prior to 5.16.3, 6.0.x prior to 6.0.3 or 6.1.x prior to 6.1.2. It is, therefore, affected by a path...

jenkins: stored cross-site scripting in update center web pages (SECURITY-1453)

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages...

CVE-2019-16183

In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions...

CVE-2019-13370

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...

CVE-2019-13370

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...

PT-2019-13298 · Ignited · Ignited Cms

Name of the Vulnerable Software and Affected Versions: Ignited CMS versions prior to 2017-02-19 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add an administrator account. This is related to the /index.php/admin/permissions endpoint...