CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

DEBIAN-CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

UBUNTU-CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-23477)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. An attacker can exploit the vulnerability to...

CVE-2009-5068

There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...

Catfish Blog has a file upload vulnerability

Catfish Blog is a free personal blogging system. A file upload vulnerability exists in Catfish Blog, which can be exploited by an attacker to upload malicious files and gain administrative privileges on the site...

Unspecified Vulnerability in Intelbras IWR 3000N

Intelbras IWR 3000N is a wireless router from Intelbras Poland. A security vulnerability exists in the Intelbras IWR 3000N version 1.8.7, which originates from the fact that when the administrator password is changed from a client's IP address, any client from that IP address can gain...

CVE-2019-15979

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system OS. For more information about...

CVE-2019-15975 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these...

File Upload Vulnerability in Pharmaceutical Sales Management Software of Guangzhou Jiapeng Software Technology Co.

Guangzhou Jiapeng Software Technology Co., Ltd. is a new type of high-tech enterprise for the pharmaceutical industry, focusing on management software research, application development and pharmaceutical information consulting services. Guangzhou Jiapeng Software Technology Co., Ltd. pharmaceutic...

File Upload Vulnerability in Website Building System of Beijing Tiandi Huada Network Technology Co.

Beijing Tiandihuada Network Technology Co., Ltd. provides comprehensive, thoughtful and professional Internet solutions for enterprises. There is a file upload vulnerability in the website building system of Beijing Tiandi Huada Network Technology Co., Ltd, which can be exploited by attackers to...

CVE-2019-20004

An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router...

ROS communications-related packages input validation error vulnerability

ROS communications-related packages is a package related to ROS Robot Operating System communications. An input validation error vulnerability exists in parseOptions in the tools/rosbag/src/record.cpp file in ROS communications-related packages version 1.14.3 and earlier. The vulnerability stems...

CVE-2019-20139

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...

GNU LibreDWG Double Release Vulnerability

GNU LibreDWG is a GNU Project C library for working with DWG files. A double release vulnerability exists in the 'dwgfree' function of the free.c file in GNU LibreDWG versions prior to 0.93. The vulnerability stems from mismanagement of system resources e.g., memory, disk space, files, etc. by a...

DEBIAN-CVE-2019-16781

In WordPress before 5.3.1, authenticated users with lower privileges like contributors can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS...

CVE-2019-6027

Cross-site request forgery CSRF vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Unspecified Vulnerability in Connect Box EuroDOCSIS 3.0 Voice Gateway

Connect Box EuroDOCSIS 3.0 Voice Gateway is a home voice gateway device. A security vulnerability exists in the administration interface of the Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH version, which originates from the program receiving a POST request on port 80...

File Upload Vulnerability in ezEIP Frontend of Wando Network Technology Co.

ezEIP is a website management system of Wando Network Technology Co. A file upload vulnerability exists in the frontend of ezEIP of Wando Network Technology Co. Ltd, which can be exploited by an attacker to gain server administrator privileges...