Remote code execution

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution RCE. Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user...

F5 Nginx 跨站脚本漏洞

The F5 NGINX Controller is a self-service, API-driven platform for managing NGINIX Plus that can be easily integrated into CI/CD workflows to accelerate application deployment and simplify application lifecycle management. user" or "admin" role access and authenticated attackers can use an...

CVE-2022-23452

An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service...

CVE-2022-21663 Authenticated Object Injection in Multisites in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3...

CVE-2021-36843

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Floating Social Media Icon plugin versions = 4.3.5 Social Media Configuration form. Requires high role user like admin...

Cross site scripting

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Floating Social Media Icon plugin versions = 4.3.5 Social Media Configuration form. Requires high role user like admin...

CVE-2021-36843 WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Floating Social Media Icon plugin versions = 4.3.5 Social Media Configuration form. Requires high role user like admin...

CVE-2021-41244

A flaw was found in grafana. When the fine-grained access control feature is enabled, and there is more than one organization in the Grafana instance, users with admin role in one organization can list, add, remove, and update users’ roles in other organizations in which they are not an admin...

Design/Logic Flaw

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a...

BetterLinks < 1.2.6 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV. PoC Go to Plugin's Settings page, in "Tool" tab, import a CSV file with Betterlinks option. Put a simple XSS payload into "linktitle"...

Admin is a single-point of failure without any mitigations

Handle 0xRajeev Vulnerability details Impact Admin role has absolute power across Swivel, Marketplace and VaultTracker contracts with several onlyOwner functions. There is no ability to change admin to a new address or renounce it which is helpful for lost/compromised admin keys or to delegate...

Additional Information About CVE-2019-4716

On February 11th the following Security Bulletin was released: https://www.ibm.com/support/pages/node/1127781 This article provides important details about CVE-2019-4716. This vulnerability impacts the TM1 database component from IBM Planning Analytics Local and IBM Planning Analytics on Cloud...

Privilege Escalation

lxdui is vulnerable to privilege escalation. The use of hardcoded secrete key in metadata.py allows an attacker to perform unauthorized access using Admin role...

PT-2022-1636 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix versions 4.0 LTS through 5.0 LTS Description: The issue allows for Remote Code Execution RCE due to authorization errors. Any user with the Zabbix Admin role can run custom shell scripts on the application server in the context of the...

Code injection

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page...

RPCMS 安全漏洞

RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS, which originates in RPCMS v1.8 and below, that can be exploited by an attacker to interact with the API to change the variable "role" to "admin" for administrator user registration...

Cross site scripting

A stored cross site scripting XSS vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...

Cisco DCNM auth bypass

This exploit is able to add an admin account to a Cisco DCNM with credentials you can choose. After that, you can login to the web interface with those credentials. The only necessary condition is the more or less recent connection of an admin as this exploit uses a kind of session stealing. Modu...

CVE-2021-25931

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at...

Cross site request forgery (csrf)

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at...