1830 matches found
CVE-2019-15011: Incorrect Default Permissions
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a...
Cross site scripting
When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...
Protect
A privilege escalation vulnerability in FortiOS may allow admin users to elevate their profile to superadmin, via restoring modified configurations...
CVE-2019-3865
A stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name...
CVE-2019-17118
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
CVE-2019-17118
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
CVE-2019-17575
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...
LimeSurvey < 3.17.14 Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Code injection
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
Code injection
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
Design/Logic Flaw
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions...
CVE-2019-16181
CVE-2019-16181 affects LimeSurvey prior to 3.17.14, where admin users can mark other users’ notifications as read. The Red Hat/NVD/OpenVAS records corroborate the same issue across multiple feeds. The vulnerability is documented with a low CVSS 3.1 base score (2.7) in NVD, indicating limited impa...
CVE-2019-16183
LimeSurvey vulnerability CVE-2019-16183 affects LimeSurvey prior to 3.17.14. The issue is an improper permissions check that allows admin users to run an integrity check without proper privileges. Affected product: LimeSurvey (PHP-based web app); vulnerable component: integrity check flow; root c...
CVE-2019-16183: Incorrect Default Permissions
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions...
CVE-2019-16185: Incorrect Default Permissions
In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions...
CVE-2019-16186: Incorrect Default Permissions
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
CVE-2019-16181: Undefined Security Weakness
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
