CVE-2019-6242

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

CVE-2019-6242

Kentico CMS v10.0.42 exposes the cleartext SMTP password on the SMTP configuration page. The issue allows Global Administrators to read the stored SMTP credentials (root cause is access to configuration data containing credentials). Impact is exposure of sensitive SMTP credentials to high-privile...

PT-2019-18047 · Kentico · Kentico

Name of the Vulnerable Software and Affected Versions: Kentico version 10.0.42 Description: The issue allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. The vendor considers this a best-practice violation but not a vulnerability. The...

Authentication Bypass by Spoofing in express-cart

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

CVE-2018-16483

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

Citrix Workspace App Launcher is unable to launch applications automatically with Safari 12

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Citrix Workspace App Launcher is not able to launch applications automatically with Safari browser...

CVE-2019-3584

Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 18.11.31.62 allows authenticated administrator users -- administrators to Remove MVision Endpoint via unspecified vectors...

CVE-2019-3584 Exploitation of Authentication vulnerability

Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 18.11.31.62 allows authenticated administrator users -- administrators to Remove MVision Endpoint via unspecified vectors...

Jenkins < 2.160 and < 2.150.2 LTS Multiple Vulnerabilities - Linux

Jenkins and is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege Escalation

ansible is vulnerable to privilege escalation attacks. The vulnerability exists as Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

Privilege Escalation

xen is vulnerable to privilege escalation attacks. The vulnerability exists as the 1 ioportread and 2 ioportwrite functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-ran...

Denial Of Service (DoS)

mysql is vulnerable to denial of service. An unspecified vulnerability allows remote administrators to deny access to the server via vectors related to Server: InnoDB...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via...

Denial Of Service (Dos)

krb5 is vulnerable to denial of service. A NULL pointer dereference in the check16dummy function in lib/kadm5/srv/svrprincipal.c allows remote authenticated administrators with create privilege to crash the process...

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12....

Umbraco CMS 7.12.4 Remote Code Execution

Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4 Category: Webapps Tested...

Umbraco CMS 7.12.4 - (Authenticated) Remote Code Execution

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link:...