CVE-2018-11774

CVE-2018-11774 affects Apache VCL versions 2.1–2.5. The issue is improper validation of form input used in SQL statements when adding/removing VMs to hosts, enabling an SQL injection described as requiring admin-level access. A fix/upgrade is advised for versions earlier than 2.5.1. The available...

D-Link DCS-1130 Command Injection Vulnerability

The D-Link DCS-1130 is a network camera from Taiwan, China-based AUO D-Link. A command injection vulnerability exists in the Recorder function in the D-Link DCS-1130. An attacker can exploit this vulnerability to take control of the device as admin user and execute arbitrary code...

Remote Code Execution (RCE)

Charka Core is vulnerable to Remote Code Execution. This is due to an improper type-check when the engine handles objects in memory. This allows an attacker to execute arbitrary codes with user permission. If the user has admin rights, the attacker can potentially take control of the system...

CVE-2019-1055

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploit...

CVE-2019-0920

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploit...

CVE-2019-6564

GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file directory, which may allow an attacker to gain administrative privileges on a system during installation or upgrade...

CVE-2019-11489

CVE-2019-11489 affects SimplyBook.me Enterprise (older releases) where the Administrative Management Interface enforces incorrect access control. Affected: authenticated low-privilege users; vulnerability allows elevation to full admin rights via a crafted HTTP PUT to a /v2/rest/ endpoint with mo...

CVE-2017-17544

A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to superadmin via restoring modified configurations...

PT-2019-1822 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to a remote code execution problem in the Chakra scripting engine of Microsoft Edge, caused by a buffer overflow in memory. This could allow an attacker to execu...

PT-2019-1823 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to a remote code execution problem in the Chakra scripting engine of Microsoft Edge, caused by a buffer overflow in memory. This could allow an attacker to execu...

CVE-2018-0630

The CVE-2018-0630 issue affects NEC Aterm W300P routers (firmware Ver1.0.13 and earlier). A command-injection flaw exists in the sysCmd parameter that allows an authenticated administrator to execute arbitrary OS commands on the device. Impact is elevated due to administrative access required; ex...

UBUNTU-CVE-2018-19039

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions...

Authentication flaw

A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances, the affected software enables a privileged user account...

CVE-2018-15439

The CVE-2018-15439 issue affects Cisco Small Business Switches (e.g., 200/250/300/350/350X/500/550X families). The root cause is a default privileged user account that is automatically enabled when no top-level accounts exist, bypassing normal authentication. This unauthenticated, remote flaw all...

The vulnerability of the Intel Computing Improvement Program’s data collection tool, caused by privilege management errors, allows a perpetrator to execute arbitrary code with administrator privileges.

The vulnerability of the Intel Computing Improvement Program’s data collection tool is caused by privilege management errors. Exploiting this vulnerability could allow a attacker to execute arbitrary code with administrator privileges...

UBUNTU-CVE-2018-16947

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller butc process accepts incoming RPCs but does not require or allow for authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, includin...

DLink DIR-601 - Credential Disclosure

Exploit Title: DLink DIR-601 - Credential Disclosure Google Dork: N/A Date: 2018-06-24 Exploit Author: Kevin Randall Vendor Homepage: https://www.dlink.com Software Link: N/A Version: Firmware: 2.02NA Hardware Version B1 Tested on: Windows 10 + Mozilla Firefox CVE : CVE-2018-12710 1. Description...

DLink DIR-601 - Credential Disclosure

DLink DIR-601 - Credential Disclosure Exploit Title: DLink DIR-601 - Credential Disclosure Google Dork: N/A Date: 2018-06-24 Exploit Author: Kevin Randall Vendor Homepage: https://www.dlink.com Software Link: N/A Version: Firmware: 2.02NA Hardware Version B1 Tested on: Windows 10 + Mozilla Firefo...

CVE-2018-12710

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account which is a low privilege account access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML...

CVE-2018-12710

CVE-2018-12710 affects D-Link DIR-601 devices (firmware about 2.02NA). A local attacker with a low-privilege User account can intercept a POST response and view the admin password in XML, gaining Admin rights. The issue is evidenced by multiple sources (NVD/NVD entry, Exploit-DB PoC, CNVD entry, ...