CVE-2022-46676

Wyse Management Suite (Dell) is affected: versions 3.8 and earlier expose an improper access control vulnerability (CVE-2022-46676) where a malicious admin can disable or delete users under administration and unassigned admins beyond the group admin’s authorization. The issue is documented with i...

CVE-2022-34451

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to...

CVE-2022-34451

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to...

CVE-2022-34450

PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially exploit this issue and gain unrestricted control/code execution on the system as root...

CVE-2022-34392

SupportAssist for Home PCs versions 3.11.4 and prior contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information...

CVE-2022-34392

SupportAssist for Home PCs versions 3.11.4 and prior contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information...

CVE-2022-34392

Dell SupportAssist for Home PCs, version 3.11.4 and earlier, has an insufficient session expiration vulnerability. An authenticated non-admin user can obtain a refresh token, reuse the access token, and access sensitive information. Root cause: improper session expiration handling. No remediation...

CVE-2022-34452

PowerPath Management Appliance with versions 3.3, 3.2, 3.1 & 3.0 contains sensitive information disclosure vulnerability. An Authenticated admin user can able to exploit the issue and view sensitive information stored in the logs...

CVE-2022-34452

PowerPath Management Appliance (Dell) versions 3.0–3.3 are affected by a sensitive information disclosure vulnerability that can be exploited by an authenticated admin to view sensitive information stored in logs. Root cause details are not provided in the documents, but remediation is available ...

PT-2023-13371 · Dell · Dell Supportassist For Home Pcs +1

Name of the Vulnerable Software and Affected Versions: SupportAssist for Home PCs versions 3.11.4 and prior SupportAssist for Business PCs versions 3.2.0 and prior Description: The issue is related to a cryptographic weakness. An authenticated non-admin user could potentially exploit this weaknes...

Cross site scripting

The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

F5 Big-IP Create Administrative User

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'unixcrypt' class MetasploitModule 'F5 Big-IP Create Admin User', 'Description' = %q This creates a local user with a username/password and root-level privileges...

CVE-2022-47132

A Cross-Site Request Forgery CSRF in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users...

F5 Big-IP Create Administrative User Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'unixcrypt' class MetasploitModule 'F5 Big-IP Create Admin User', 'Description' = %q This creates a local user with a username/password and root-level privileges...

MPX/SDX Series 9100/16000, GUI LOM access to configuration settings are read-only

On a new MPX/SDX 9100/16000 appliance, LOM Access works fine via the CLI shell; however, while LOM Access and login via GUI are functional, the settings menu is disabled grayed out, preventing any changes from being made. It behaves as if there is read-only access even when logged in as the admin...

ShortPixel Adaptive Images < 3.6.3 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin PoC https://example.com/?SPAIVJS=%3C/script%3E%3Cimg%20src%3D1%20onerror%3Dalert/XSS/;%3E...

CVE-2022-46087

CloudSchool v3.0.1 is vulnerable to Cross Site Scripting XSS. A normal user can steal session cookies of the admin users through notification received by the admin user...

HTML Injection

Overview com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to HTML Injection. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update. Details Cross-site scripting or XSS is a code...

CVE-2022-4320

The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users such as high-privilege ones like admin...

Cross site scripting

The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege...