PT-2020-15311 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.218 and earlier Jenkins LTS versions 2.204.1 and earlier Description: The issue allows users with Overall/Read access to view a JVM memory usage chart, which could potentially disclose sensitive information about the system...

Centreon Poller Authenticated Remote Command Execution

An authenticated user with sufficient administrative rights to manage pollers can use this functionality to execute arbitrary commands remotely. Usually, the miscellaneous commands are used by the additional modules to perform certain actions, by the scheduler for data processing, etc. This modul...

File Upload Vulnerability in Light Forum System of Roving Cloud

Cruise Cloud Light Forum System is an open source web application based on JAVA + MYSQL architecture, including forums, Q&A modules. Patrol Cloud Light Forum System has a file upload vulnerability that can be exploited by an attacker to upload malicious files and gain access to the site...

Vulnerability of ACE Mingyi's O&M Audit Risk Control System to overstepping of authority

DASUSM is an audit and risk control system based on the theory and practical experience of operation and maintenance security management, combined with the requirements of various laws and regulations e.g., level protection, SOX, PCI, enterprise internal control management, hierarchical protectio...

CVE-2019-19681

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual...

CVE-2019-19681

Pandora FMS 7.x is reported to have a remote code execution vulnerability (CVE-2019-19681) that can be triggered by an authenticated user who can modify the alert system, allowing execution of commands as root/Administrator. The Red Hat entry and other sources reiterate the issue and include vend...

CVE-2019-19681

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual...

ThreatList: Admin Rights for Third Parties is the Norm

Organizations are continuing to fall down on the job when it comes to addressing cybersecurity risk around third parties; in fact, 61 percent of respondents in a recent survey said they’re unsure if partners, contractors, suppliers and others are accessing or attempting to access unauthorized dat...

CVE-2019-8291

Online Store System v1.0 deletefile.php doesn't check to see if a user has administrative rights nor does it check for path traversal...

CVE-2019-8292

Online Store System v1.0 deleteproduct.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion...

PT-2019-18969 · Unknown · Online Store System

Name of the Vulnerable Software and Affected Versions: Online Store System version 1.0 Description: The issue concerns the delete product.php file in the Online Store System, which fails to verify if a user is authenticated or has administrative rights. This oversight allows for arbitrary product...

File Upload Vulnerability in Luthor's All Media Platform

Luthor's all-media platform is a comprehensive realization of the integration of media collection, editing, distribution and storage, and provides media users with an efficient work platform that can replace the current collection and editing system, solve the media process, and provide more...

CVE-2019-5976

Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors...

PT-2019-3202 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Internet Explorer affected versions not specified Description: A remote code execution issue exists due to the way the scripting engine handles objects in memory. This could allow an attacker to execute arbitrary code in the context of the...

Windows File Enumeration Intel Gathering Tool 2.1

from subprocess import Popen, PIPE import sys,argparse,re NtFileSins v2.1 Fixed: save logic to log report in case no Zone.Identifiers found. Added: Check for Zone.Identifer:$DATA to see if any identified files were downloaded from internet. Windows File Enumeration Intel Gathering. Standard users...

Nagios XI 5.6.5 - Remote Code Execution / Root Privilege Escalation

?php / A vulnerability exists in Nagios XI = 5.6.5 allowing an attacker to leverage an RCE to escalate privileges to root. The exploit requires access to the server as the 'nagios' user, or CCM access via the web interface with perissions to manage plugins. The getprofile.sh script, invoked by...

CVE-2019-1144

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data...

Sql injection

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of securi...

Sql injection

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node if any was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires adm...

CVE-2018-11774

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of securi...