USN-3300-1 juju-core vulnerability

Ryan Beisner discovered juju did not set permissions on a Unix domain socket. A local attacker could use this flaw to gain administrative privileges...

Faveo Cross-Site Request Forgery Vulnerability

Faveo is an open source , based on the Laravel framework of the ticket management system . A cross-site request forgery vulnerability exists in public/rolechangeadmin in Faveo version 1.9.3. A remote attacker can exploit this vulnerability to gain administrator privileges...

HelpDEZk Cross-Site Request Forgery Vulnerability

HelpDEZk is a suite of PHP-based software for managing requests, events. A cross-site request forgery vulnerability exists in admin/home/person/ in HelpDEZk. It allows remote attackers to construct malicious URIs and trick users into parsing them, which can be used to perform malicious actions an...

CVE-2017-7571

public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges...

CVE-2017-7571

public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges...

CVE-2017-7571

public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges...

CVE-2017-7571

The CVE-2017-7571 entry concerns Faveo Open Source (ticketing system) version 1.9.3, where a CSRF in public/rolechangeadmin enables privilege escalation to administrator. The vulnerability is described as CSRF leading to admin rights, with public/rolechangeadmin being the affected component and F...

CVE-2017-7571: Cross-Site Request Forgery (CSRF)

public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges...

PT-2017-17807

Name of the Vulnerable Software and Affected Versions Faveo version 1.9.3 Description The issue allows for CSRF, potentially resulting in obtaining admin privileges. The affected endpoint is "public/rolechangeadmin". Recommendations For Faveo version 1.9.3, update to a version that includes a fix...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability of Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrative privileges of the current user and execute arbitrary code using a specially crafted...

Cross site request forgery (csrf)

HelpDEZk 1.1.1 has CSRF in admin/home/person/ with an impact of obtaining admin privileges...

CVE-2017-7446

HelpDEZk 1.1.1 has CSRF in admin/home/person/ with an impact of obtaining admin privileges...

CVE-2017-7446

HelpDEZk 1.1.1 has CSRF in admin/home/person/ with an impact of obtaining admin privileges...

CVE-2017-7446

HelpDEZk 1.1.1 is affected by a Cross-Site Request Forgery vulnerability in admin/home#/person/ that can lead to admin privileges. The CVE entry, confirmed across multiple sources, notes CSRF as the root cause in HelpDEZk’s web interface, with public exploit coverage (Exploit-DB, PacketStorm) ind...

CVE-2017-7446

HelpDEZk 1.1.1 has CSRF in admin/home/person/ with an impact of obtaining admin privileges...

PT-2017-17742

Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1 Description The issue allows for obtaining admin privileges through CSRF in the "admin/home/person/" endpoint. Recommendations For HelpDEZk version 1.1.1, update to a version that includes a fix for this issue, as using...

CVE-2017-7446: Cross-Site Request Forgery (CSRF)

HelpDEZk 1.1.1 has CSRF in admin/home/person/ with an impact of obtaining admin privileges...

CVE-2017-7400

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

DHCP Exhaustion Script: DHCPig

DHCP Exhaustion Script DHCPig initiates an advanced DHCP exhaustion attack. It will consume all IPs on the LAN, stop new users from obtaining IPs, release any IPs in use, then for good measure send gratuitous ARP and knock all windows hosts offline. It requires scapy =2.1 library and admin...

Local Windows Admins Can Hijack Sessions Without Credentials

A researcher has exposed how attackers with local admin privileges could use native command-line Windows tools to hijack other users’ sessions without credentials. Researcher Alexander Korznikov on Friday published a report in which he describes how he could, locally and remotely via Remote Deskt...