i-doit Trust Management Issues Vulnerabilities

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in i-doit pro and i-doit open that stems from a security flaw in the default administrator credentials. An attacker could exploit this vulnerability to gain administrator privileges and execute...

PT-2023-23852 · Tenable · Nessus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An arbitrary file write issue exists, allowing an authenticated, remote attacker with administrator privileges to alter logging variables. This could...

PT-2023-33070 · Npm +1 · Npm +1

Name of the Vulnerable Software and Affected Versions: Saltcorn versions prior to 0.8.7 Description: The issue allows an untrusted user with admin rights to a tenant instance to install a plugin that can access information from other tenants, potentially compromising all tenants of the...

Potential Exploitation of _acceptAdmin Function.

Lines of code Vulnerability details Impact If this vulnerability is exploited, an attacker can wrongfully gain access to the admin role. This can lead to unauthorized control over the contract, allowing the attacker to manipulate critical functionalities and potentially cause financial losses or...

GHSA-J2R7-3RVW-G7GX Apache Pulsar Broker's Rest Producer vulnerable to Incorrect Authorization

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from...

CVE-2023-3127

CVE-2023-3127 concerns improper authentication in Sensormatic Electronics iSTAR devices (Ultra, Ultra LT, Ultra G2, Edge G2). The vulnerability allows an unauthenticated user to login with administrator rights, with CVSS v3.1 base score 7.5 (AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) per CISA ICS and N...

CVE-2020-18409

Cross Site Request Forgery CSRF vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...

ZOHO ManageEngine ADSelfService Plus 访问控制错误漏洞

ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. An access control error vulnerability exists in ZOHO ManageEngine ADSelfService Plus version 6113 and prior versions, which stems fro...

Rockwell Automation FactoryTalk Services Platform 信任管理问题漏洞

Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation, Inc. that consists of multiple products that provide applications with routine services such as diagnostic information, health monitoring, and real-time data access. A security vulnerabili...

Splunk 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

PT-2023-20110 · WordPress · Jch Optimize

Name of the Vulnerable Software and Affected Versions: JCH Optimize plugin versions 3.2.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the JCH Optimize plugin. This vulnerability requires authentication with admin+ privileges...

Jellyfin 跨站脚本漏洞

Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex, and can serve media from a dedicated server to end-user devices through multiple applications. Jellyfin suffers from a cross-site scripting...

GHSA-44H9-XXVX-PG6X XWiki App Within Minutes app grants space admin rights that allows cross-site scripting

Impact Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can be exploited by creating an app in App Within Minutes. If the button should be disabled because th...

XWiki App Within Minutes app grants space admin rights that allows cross-site scripting

Impact Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can be exploited by creating an app in App Within Minutes. If the button should be disabled because th...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

CVE-2023-29515 Cross-site scripting (XSS) in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

PT-2023-14524 · WordPress · Denis Buka Content Repeater – Custom Posts Simplified

Name of the Vulnerable Software and Affected Versions: Denis Buka Content Repeater – Custom Posts Simplified plugin versions prior to 1.1.14 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

PT-2023-17222 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper privilege management, allowing any user who can add a new user to create a user with super admin rights. This has been fixed in version 3.1.12. Recommendation...

PT-2023-21029 · Cynet · Cynet Client Agent

Name of the Vulnerable Software and Affected Versions: Cynet Client Agent version 4.6.0.8010 Description: The issue allows attackers with Administrator rights to disable the EDR functions by disabling process privilege tokens. Recommendations: For Cynet Client Agent version 4.6.0.8010, consider...