2928 matches found
CVE-2020-21046
A local privilege escalation vulnerability was identified within the "luminatinetupdaterwineaglegetcom" service in EagleGet Downloader version 2.1.5.20 Stable. This issue allows authenticated non-administrative user to escalate their privilege and conduct code execution as a SYSTEM privilege...
CVE-2022-32400
Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manageuser.php:4...
CVE-2022-32400: Improper Neutralization of Special Elements used in an SQL Command
Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manageuser.php:4...
CVE-2022-33049
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manageuser...
CVE-2022-1895
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack...
CVE-2022-32341
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manageuser&id=...
Design/Logic Flaw
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...
CVE-2022-32252
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...
CVE-2022-32252
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...
CVE-2022-1335
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...
Privilege escalation
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29093
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29092
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29092: Uncontrolled Search Path Element
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29093: Improper Limitation of a Pathname to a Restricted Directory
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29094: Improper Limitation of a Pathname to a Restricted Directory
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...
Relative path traversal vulnerability in CLI
...
CVE-2022-1684: Improper Neutralization of Special Elements used in an SQL Command
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...