Open Microscopy Environment OMERO.server Information Disclosure Vulnerability

Open Microscopy Environment OMERO.server is an open source image management platform. The platform supports a variety of image file formats , and image management , viewing and editing operations. An information disclosure vulnerability exists in Open Microscopy Environment OMERO.server versions...

Tiki cross-site scripting vulnerability (CNVD-2018-17537)

Tiki is a suite of open source content management and portal applications from the Tiki software community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in Tiki versions prior to 18.2, 15.7, and 12.14. A...

CVE-2018-14850

Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image...

Cross site scripting

Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

openSUSE Security Update : znc (openSUSE-2018-819)

This update for znc fixes the following issues : - Update to version 1.7.1 - CVE-2018-14055: non-admin user could gain admin privileges and shell access by injecting values into znc.conf bnc1101281 - CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin name. bnc1101280 - Update to...

Security update for znc (moderate)

This update for znc fixes the following issues: - Update to version 1.7.1 CVE-2018-14055: non-admin user could gain admin privileges and shell access by injecting values into znc.conf bnc1101281 CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin name. bnc1101280 - Update to...

Security update for znc (moderate)

This update for znc fixes the following issues: - Update to version 1.7.1 CVE-2018-14055: non-admin user could gain admin privileges and shell access by injecting values into znc.conf bnc1101281 CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin name. bnc1101280 - Update to...

CVE-2018-0613

NEC Platforms Calsos CSDX and CSDJ series products CSDX 1.37210411 and earlier, CSDXP 4.37210411 and earlier, CSDXD 3.37210411 and earlier, CSDXS 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00 allows remote...

Jenkins 配置文件路径改动导致管理员权限开放漏洞(CVE-2018-1999001)

CVE-2018-1999001 为配置文件路径改动漏洞。远程且未经授权的攻击者可以通过构造恶意登录凭证，从 Jenkins 主目录下移除 config.xml 配置文件到其他目录，从而导致 Jenkins 服务下次重启时退回 legacy 模式，对匿名用户也会开放管理员权限，如下图所示： CVE-2018-1999001 漏洞利用的条件是需要等待 Jenkins 服务的重启。...

Multiple OS command injection vulnerabilities in Aterm WG1200HP

Overview Aterm WG1200HP provided by NEC Corporation contains multiple OS command injection vulnerabilities CWE-78. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

Design/Logic Flaw

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

Command injection

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability both on the server and on devices by sending malformed parameters in sensor or...

CVE-2018-1457

An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privileges. IBM X-Force ID: 140208...

CVE-2018-1457

Summary of CVE-2018-1457 (IBM Rational DOORS) : A vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 could allow an attacker to gain DOORS administrator privileges. The publicly documented details in the IBM bulletin specify affected products/components as Rational DOORS desktop client an...

Cross site scripting

WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...

Sql injection

The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page...

CVE-2018-12636

The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page...

iThemes Security <= 7.0.2 - Authenticated SQL Injection

The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page. Vulnerability description: iThemes Security appears to be vulnerable to time-based SQL-Injection. Parameter orderby is vulnerable because backend...