3115 matches found
CVE-2023-21172
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Design/Logic Flaw
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
ownCloud: Cross-Site Request Forgery
A cross-site request forgery vulnerability was found in an application. Requests were not validating cross-site request forgery tokens, allowing an unauthorized user to perform administration functions by inserting valid session cookies into arbitrary requests. This could have enabled an attacker...
PT-2023-17961 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: A permissions bypass issue in multiple functions of WifiCallingSettings.java allows changing calling preferences for the admin user. This could lead to local escalation of privilege wit...
CVE-2023-21173
CVE-2023-21173 affects Android 13 where multiple methods in DataUsageList.java can reveal admin network activity due to a missing permission check, enabling local information disclosure with no extra privileges or user interaction. The vulnerability is documented across multiple feeds (NVD, Red H...
CVE-2023-1166 USM Premium < 16.3 - Admin+ Stored XSS
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup...
Input validation
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
Input validation
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
Input validation
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
Input validation
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
CVE-2023-25937
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
GHSA-PM73-X2H5-CMJ3 Apache StreamPipes Improper Privilege Management vulnerability
A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...
CVE-2023-28059
Dell BIOS contains an improper input validation vulnerability that can allow a local authenticated administrator to modify a UEFI variable. Affected component: Dell BIOS (embedded BIOS on Dell motherboards). Root cause: improper input validation. Impact: potential unauthorized modification of UEF...
Cross site request forgery (csrf)
A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...
CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user
A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...
CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user
A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...
CVE-2023-31469: Improper Privilege Management
A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...
PT-2023-21506 · Dell · Dell Bios
Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability to modify...
CVE-2020-21489: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component...
