CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

PT-2018-13972

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.3 Build 123196 Description The issue allows unauthorized access to certain API endpoints without requiring authentication. Specifically, the /oputilsServlet endpoint can be exploited to obtain a...

Receiver throws the following error on connecting to the Store: An error has occurred in the script on this page - File://C:/Cusers/xxxx/AppData/Local/Citrix/SelfService/Web/xxxx/1/custom/script.js

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Receiver 4.9.2000 throws the following error on connecting to the Store: An error has occurred in th...

CVE-2018-17153

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

Authentication flaw

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

CVE-2018-17131: Improper Control of Generation of Code

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...

PT-2018-13912

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue allows admin users to execute arbitrary code via the varvalue field in the admin/web config.php file. Recommendations For PHPMyWind version 5.5, restrict access to the admin/web config.php file to...

CVE-2018-17104

An issue was discovered in Microweber 1.0.7. There is a CSRF attack against the admin user that can add an administrative account via api/saveuser...

CVE-2018-17104: Cross-Site Request Forgery (CSRF)

An issue was discovered in Microweber 1.0.7. There is a CSRF attack against the admin user that can add an administrative account via api/saveuser...

Vanilla: Vanilla Forums Xenforo password splitHash Unserialize Remote Code Execution Vulnerability

Summary: An authenticated admin user can inject an unserializable password in a another users account. Later when attempting a login with that user, the attacker can trigger a call to an unserialize in the splitHash function. By using a custom pop chain to write into the constants.php file, an...

Vanilla: Vanilla Forums Gdn_Format unserialize() Remote Code Execution Vulnerability

Summary: An authenticated admin user can trigger a call to unserialize which can allow an attacker to gain remote code execution. Description: Please bare with me on this one, it's heavy. Ok, so after setting a Garden.TouchIcon setting it can be several settings, this is just an example of one we...

osCommerce 2.3.4.1 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: osCommerce Add Admin User CSRF Vulnerability Exploit Author: Hesam Bazvand Contact: email protected Download Link: https://www.oscommerce.com/Products&Download=oscom2341 Tested on: Windows 10 / Kali Linux Category: WebApps...

LimeSurvey <= 3.14.7 Multiple Vulnerabilities

LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-16447: Cross-Site Request Forgery (CSRF)

Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF...

CVE-2018-16397

In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,...

CVE-2018-16397

In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,...

CVE-2018-16397

In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,...

PT-2018-13546

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 3.14.7 Description The issue allows an admin user to read an arbitrary file by leveraging a "file upload" question. Recommendations For versions prior to 3.14.7, update to version 3.14.7 or later to resolve the iss...

CVE-2018-16339: Cross-Site Request Forgery (CSRF)

An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser...

CVE-2018-15851: Cross-Site Request Forgery (CSRF)

An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/user/add...