1925 matches found
CVE-2018-17132
CVE-2018-17132 affects PHPMyWind 5.5: admin/goods_update.php can be abused by Admin users to execute arbitrary code via the attrvalue[] array parameter. The vulnerability arises from how the parameter is handled, enabling code execution with admin privileges. The connected documents confirm the a...
CVE-2018-17132: Improper Control of Generation of Code
admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...
CVE-2018-17085
An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...
CVE-2018-17085
An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr...
CVE-2018-15695
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi...
CVE-2018-15694
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled...
CVE-2018-15845
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...
PT-2018-13234
Name of the Vulnerable Software and Affected Versions Gleez CMS version 1.2.0 Description The issue allows for a CSRF attack that can add an administrator account. This is achieved via the "admin/users/add" API endpoint, utilizing the admin/users/add path. Recommendations For Gleez CMS version...
CVE-2018-15845: Cross-Site Request Forgery (CSRF)
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...
CVE-2018-14791
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected products...
Insecure Default Configuration
tripleoheattemplates is vulnerable to insecure default configuration. The vulnerabilty exists due to the default configuration set for the OpenDayLight ODL admin users' credentials, allowing malicious users to gain unauthorized access...
CVE-2017-7470
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...
CVE-2017-7470
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...
CVE-2017-7470
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...
Server side request forgery (ssrf)
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...
CVE-2018-1999017
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...
CVE-2018-1999017
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...
CVE-2018-1999017
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...
CVE-2018-1245
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component ACM. A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a...