4085 matches found
Authentication Risks Discovered in Okta Platform
Researchers at Authomize have discovered four “high impact” security risks in the identity and access management IAM platform Okta, according to a Tuesday report. The risks include cleartext password leakage via SCIM – the System for Cross-domain Identity Management – sharing of passwords and oth...
CVE-2022-30620
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...
Easy Username Updater < 1.0.5 - Arbitrary Username Update via CSRF
The plugin does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin PoC...
CVE-2022-2149
The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-2194
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-2100
The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-35169
SAP BusinessObjects Business Intelligence Platform LCM - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on...
Siemens RUGGEDCOM ROX 系列命令注入漏洞
RUGGEDCOM products provide a level of robustness and reliability that sets the standard for communication networks deployed in harsh environments. Siemens RUGGEDCOM ROX has a command injection vulnerability that could be exploited by an attacker with administrator privileges to access the shell o...
Remote Code Execution
snipe/snipe-it is vulnerable to remote code execution. The vulnerability exists in the Select User function under the People Menu component which allows an attacker with admin privileges to inject remote code to a user via maliciously crafted pdf files...
CVE-2022-24140
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file a...
Remote code execution
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file a...
CVE-2022-2254
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users...
Design/Logic Flaw
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server...
CVE-2022-2254
CVE-2022-2254 affects Distributed Data Systems WebHMI, version 4.1.1.7662 (and possibly prior versions). The vulnerability arises from improper neutralization of input during web page generation, enabling a user with administrative privileges to store a script that could impact other logged-in us...
Distributed Data Systems WebHmi 操作系统命令注入漏洞
Distributed Data Systems WebHmi is a Scada system with a built-in web server from Distributed Data Systems, Ukraine. It is used to monitor and control any automation system on a local network and over the Internet from computers and mobile devices. An operating system command injection...
Distributed Data Systems WebHmi 跨站脚本漏洞
Distributed Data Systems WebHmi is a Scada system with a built-in web server from Distributed Data Systems, Ukraine. It is used to monitor and control any automation system on a local network and over the Internet from computers and mobile devices. A cross-site scripting vulnerability exists in...
The vulnerability of the kernel-level driver nvlddmkm.sys of the NVIDIA GPU Display Driver allows a attacker to disclose protected information, compromise data integrity, and cause service failures.
The vulnerability of the kernel-level driver nvlddmkm.sys of the NVIDIA GPU Display Driver is related to access control deficiencies. Exploiting this vulnerability can allow attackers to disclose sensitive information, compromise data integrity, and cause service failures by gaining administrativ...
CVE-2022-2088
An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0...
