CVE-2022-28173

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices...

CVE-2022-4112

The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2022-7140 · Zoho · Zoho Manageengine Device Control Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Device Control Plus version 10.1.2228.15 Description: An issue in the endpoint protection agent of Zoho ManageEngine Device Control Plus allows bypassing USB restrictions by using a virtual machine VM, enabling file exchange...

PT-2022-27715 · Shoplazza · Shoplazza Lifestyle

Name of the Vulnerable Software and Affected Versions: Shoplazza LifeStyle version 1.1 Description: A vulnerability was found in the Product Carousel Handler component, affecting an unknown part of the file /admin/api/theme-edit/. The manipulation of the Heading/Description argument leads to...

MGASA-2022-0466 Updated couchdb packages fix security vulnerability

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front o...

CVE-2022-25627

An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...

U.S. Department of State: Accessing unauthorized administration pages and seeing admin password - speakerkit.state.gov

Vulnerability description not provided...

CVE-2022-46071

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access...

Sql injection

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access...

CVE-2022-46071

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access...

CVE-2022-46071

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access...

CVE-2022-23741 Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in...

CVE-2022-23741 Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in...

PT-2022-16037 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 Description: The issue is related to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module. This allows attackers to expose...

CVE-2022-46404

The CVE-2022-46404 issue affects Atos Unify OpenScape 4000 Assistant and OpenScape 4000 Manager. A command-injection vulnerability exists in the affected components, with versions affected as 8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4, which could allow an unauthenticated atta...

Microsoft Windows Sysinternals Sysmon < 14.13 Elevation of Privilege (November 2022)

An elevation of privilege vulnerability exists in Microsoft Windows Sysinternals Sysmon prior to 14.13. A locally authenticated attacker who successfully exploited the vulnerability could manipulate information on the Sysinternals services to achieve elevation from local user to SYSTEM admin. Not...

PT-2022-25777 · Sap · Sap Commerce Webservices

Name of the Vulnerable Software and Affected Versions: SAP Commerce Webservices 2.0 Swagger UI versions 1905, 2005, 2105, 2011, 2205 Description: The issue is due to a lack of proper input validation, allowing malicious inputs from untrusted sources. This can be leveraged by an attacker to execut...

PT-2022-24487 · WordPress · Livemesh Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Livemesh Addons for Elementor WordPress plugin versions prior to 7.2.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...

WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS

The plugin does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin. 1. Install and activate WooCommerce dependency, no setup required 2. Install and activate the...

CVE-2022-46383

RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a public API endpoint Incorrect Access Control. The token can be used to escalate privileges within the Digital Rebar system and grant full...