4069 matches found
CVE-2018-16161
OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations...
CVE-2018-16161
OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations...
CVE-2018-16161
OpenDolphin (OpenDolphin 2.7.0 and earlier) is affected by CVE-2018-16161, a privilege-escalation vulnerability that allows an authenticated user to gain administrative privileges and perform unintended operations. The vulnerability is confirmed across multiple sources (NVD entry CVE-2018-16161) ...
CVE-2018-3696
Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administrative privileges via local access...
CVE-2018-19114
An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindocid value containing the relative pathname of this uploaded file. For example, the...
CVE-2018-19114
An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindocid value containing the relative pathname of this uploaded file. For example, the...
CVE-2018-15394
A vulnerability in the Stealthwatch Management Console SMC of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system...
D-Link DWR/DAP 'EXCU_SHELL' RCE Vulnerability - Active Check
D-Link DWR and DAP Routers are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
Apache Syncope Cross-Site Scripting Vulnerability
Apache Syncope is an open source system for managing digital identities in enterprise environments, implemented using Java EE technology and released under the Apache 2.0 license. A stored cross-site scripting vulnerability exists in Apache Syncope. A malicious user with sufficient administrative...
GHSA-XGC9-9W4V-H33H High severity vulnerability that affects org.apache.syncope:syncope-core
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file write, and code execution...
Adaptable, All-in-One Android Trojan Shows the Future of Malware
A new Android trojan, dubbed “GPlayed”, has been identified by researchers who said the malware is both extremely dangerous and could herald a new and very dangerous age for malicious code, according to Cisco Talos researchers. The trojan has all of the capabilities of a banking trojan as well as...
CVE-2018-0436
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between use...
Security Bulletin: Vulnerabilities in GSKit affect IBM Spectrum Scale used by DB2® pureScale™ (CVE-2018-1431, CVE-2018-1447, CVE-2017-3732, CVE-2016-0705)
Summary DB2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version V4.2 and V4.1 that is used by DB2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS. Vulnerability Details CVEID: CVE-2018-1431 DESCRIPTION: A vulnerabilit...
Western Digital My Cloud Authentication Bypass
------------------------------------------------------------------------ Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges ------------------------------------------------------------------------ Remco Vermeulen, September 2018...
Active Spy Campaign Exploits Unpatched Windows Zero-Day
The recently discovered Windows zero-day – which still doesn’t have a patch – has been used in the wild for the last week, with an active info-stealing campaign emerging just two days after its disclosure on Twitter. The flaw is a local privilege escalation vulnerability in the Windows Task...
Code Execution Vulnerability in State Micro CMS
State Micro CMS is a CMS system developed by Guangzhou State Micro Software Technology Co. A code execution vulnerability exists in SMiCMS, which can be exploited by an attacker to gain administrator privileges and execute system commands...
Cross site request forgery (csrf)
Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...
Pandao Editor.md Cross-Site Scripting Vulnerability
Pandao Editor.md is an open source online Markdown a markup language editor components. A cross-site scripting vulnerability exists in Pandao Editor.md version 1.5.0, which can be exploited by remote attackers to gain administrator privileges with a specially crafted invalid IMG element attribute...
Design/Logic Flaw
HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 edge and before 18.06.0-ce-win72 stable deserialized requests over the \.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users"...