3093 matches found
PT-2019-9592
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5 Description The issue allows for CSRF, enabling the addition of a user account through an action to e/admin/user/ListUser.php. This is achieved by utilizing the enews=AddUser action. Recommendations For EmpireCMS version...
Apache Airflow vulnerable to Stored XSS
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...
OOP CMS BLOG 1.0 Cross Site Request Forgery / SQL Injection Vulnerabilities
Exploit for php platform in category web applications Exploit Title: OOP CMS BLOG 1.0 - SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: http://zsoft.com.bd/ Software Link :...
Cross-Site Scripting (XSS)
apache-airflow is vulnerable to cross-site scripting XSS. An admin user is able to inject arbitrary Javascript into a victim's browser through the modification of state of objects in the metadata database, which would execute on certain page views...
CVE-2018-20244
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...
CVE-2018-20244: Improper Neutralization of Input During Web Page Generation
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...
Cross site request forgery (csrf)
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
CVE-2019-9040
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
CVE-2019-9040
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
CVE-2019-9040
CVE-2019-9040 affects S-CMS PHP v3.0, reporting a CSRF flaw that allows adding a new admin user via the admin/ajax.php?type=admin&action=add URI (related to CVE-2018-19332). The connected Red Hat/PRION/NVD entries confirm the same vector: CSRF enabling admin user creation. The root cause is impro...
CVE-2019-9040
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
PT-2019-19329
Name of the Vulnerable Software and Affected Versions S-CMS PHP version 3.0 Description The issue allows for a CSRF attack to add a new admin user via the "admin/ajax.php?type=admin&action=add" API endpoint. Recommendations For S-CMS PHP version 3.0, consider disabling access to the...
CVE-2019-9040: Cross-Site Request Forgery (CSRF)
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
M/Monit 3.7.2 - Privilege Escalation
!/usr/env/python3 """ Vulnerability title: M/Monit = 3.7.2 - Privilege Escalation Author: Dolev Farhi Vulnerable version: 2.0.151021 Link: https://mmonit.com Date: 2/17/2019 """ import sys import requests MMONITURL = 'http://ip.add.re.ss:8080' MMONITUSER = 'monit' Default built in unprivileged us...
LayerBB 1.1.2 Cross Site Request Forgery
Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description: LayerBB is a free open-source forum software, the CSRF...
LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin)
Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description: LayerBB is a free open-source forum software, the CSRF...
CVE-2019-6527: Improper Authentication
PR100088 Modbus gateway versions prior to Release R02 or Software Version 1.1.13166 may allow an attacker to be able to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted...
CVE-2019-0016
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Spac...
Privilege Escalation
spacewalk-backend is vulnerable to privilege escalation attacks. The vulnerability exists as it was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...