CVE-2018-5413

Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation...

Design/Logic Flaw

Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be...

Design/Logic Flaw

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...

CVE-2018-2499

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...

CVE-2018-2499

The CVE-2018-2499 entry concerns SAP Financial Consolidation Cube Designer. A security weakness could allow an attacker to discover the password hash of an admin user. The issue is addressed by fixes in BOBJ_EADES for versions 8.0 and 10.1. No exploitation details are provided beyond this descrip...

CVE-2018-2499

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...

CVE-2018-2499: Undefined Security Weakness

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

PT-2019-9408

Name of the Vulnerable Software and Affected Versions CouchDB versions prior to 2.3.0 Description The issue allowed CouchDB admin users to access the underlying operating system as the CouchDB user, potentially leading to full system entry for unauthenticated users when combined with other...

Cross site request forgery (csrf)

TEMMOKU T1.09 Beta allows admin/user/add CSRF...

CVE-2018-20613: Cross-Site Request Forgery (CSRF)

TEMMOKU T1.09 Beta allows admin/user/add CSRF...

PT-2018-15477

Name of the Vulnerable Software and Affected Versions TEMMOKU T1.09 Beta Description The issue allows for a CSRF attack on the admin/user/add functionality. Recommendations For TEMMOKU T1.09 Beta, consider implementing CSRF protection mechanisms to prevent unauthorized requests to the...

Keybase: macOS privilege escalation via keybase install

Environment OS: macOS Mojave 10.14.1 Kernel: Darwin Kernel Version 18.2.0 keybase version 2.12.2-20181218171841+29273f4110 Steps to reproduce Note: All steps are executed as an unprivileged user unless otherwise noted. For this PoC the unprivileged user is defined as below $ id test2 uid=508test2...

CVE-2018-20193: Improper Privilege Management

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

PT-2018-15290

Name of the Vulnerable Software and Affected Versions Secure Access SA Series SSL VPN versions 4.2 through 5.1R5 Description The issue allows for privilege escalation. This is demonstrated by the ability of a readonly user to change the administrator user password. The exploitation occurs because...

CVE-2018-6978

vRealize Operations 7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876 contains a local privilege escalation vulnerability due to improper permissions of support scripts. Admin user of the vROps application with shell access may exploit this issue to elevate th...

CVE-2018-6978

CVE-2018-6978 affects VMware vRealize Operations (vROps) Manager. A local privilege escalation exists due to improper permissions on support scripts, enabling an admin user with shell access to elevate to root on the vROps host. Affected products/versions: vROps 7.x prior to 7.0.0.11287810; 6.7.x...

VMSA-2018-0031:vRealize Operations updates address a local privilege escalation vulnerability

VMSA-2018-0031 vRealize Operations updates address a local privilege escalation vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0031 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: vRealize Operations updates address a local...

Synaccess netBooter NP-02x/NP-08x 6.8 - Authentication Bypass Vulnerability

Exploit for cgi platform in category web applications Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Vendor: Synaccess Networks Inc. Product web page: https://www.synaccess-net.com Affected version: NP-0201D ver 6.8C NP-02 ver 6.5C NP-02 ver 6.4BC NP-0801D ver 6.4A NP-08 ver 6.10 NP-...