CVE-2020-6192

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management...

CVE-2020-6191

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation...

Input validation

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation...

Design/Logic Flaw

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management...

CVE-2020-6191

CVE-2020-6191 describes a vulnerability in SAP Landscape Management 3.0 where an attacker with admin privileges can cause the SAP Host Agent to execute arbitrary code with root privileges due to Missing Input Validation. The connected sources (NVD, Red Hat, CNVD, CNVD-like entries, and related no...

CVE-2020-6191

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation...

IBM Planning Analytics Cross-Site Request Forgery Vulnerability

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. IBM Planning Analytics suffers from a cross-site request forgery vulnerability that can be exploit...

CVE-2020-3118

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisc...

File upload vulnerability in Blue Sky Collector of Nanchang Joran Technology Co.

Zoran Technology Co., Ltd. is a service-oriented enterprise with drones as the guide, and a precision agriculture big data service-oriented company with Internet+Agriculture. Nanchang Zhuolan Technology Co., Ltd. blue sky collector file upload vulnerability, attackers can use the vulnerability to...

Design/Logic Flaw

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

CVE-2017-14807

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects:...

Sql injection

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects:...

Huawei EulerOS: Security Advisory for PackageKit (EulerOS-SA-2018-1183)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-6960

CVE-2020-6960 affects Honeywell MAXPRO VMS & NVR: HNMSWVMS and HNMSWVMSLT (VMS560 Build 595 T2-Patch) and MAXPRO NVR XE/SE/PE + MPNVRSWXX (NVR 5.6 Build 595 T2-Patch). The issue is an SQL injection (CWE-89) allowing remote unauthenticated access to the web UI with administrator privileges. Mitiga...

PYSEC-2020-162

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

Dropbox: Local Privilege Escalation on Dropbox Desktop for Windows

This report describes a local privilege escalation in the Dropbox automatic updater process on Windows. It would allow a malicious actor who had already gained non-admin access to a Windows computer to obtain admin privileges, if Dropbox had previously been installed with admin privileges. This...

CVE-2012-2931

PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file...

Code injection

PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file...

CVE-2012-2931

PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file...

CVE-2012-2931

CVE-2012-2931 affects TinyWebGallery prior to 1.8.8. The vulnerability arises from unsanitized input in the admin user-creation flow: the POST parameter for user is written into .htusers.php, and a remote authenticated admin can inject arbitrary PHP code, enabling code execution via admin/index.p...