PT-2018-17115 · Mit +4 · Mit-Krb5 +4

Name of the Vulnerable Software and Affected Versions: MIT krb5 versions 1.6 or later Description: The issue allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check. This can be done by supplying both a linkdn and...

CVE-2017-15637

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptpserver.lua file...

CVE-2017-16788

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploadi...

UBUNTU-CVE-2017-11183

front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter...

PT-2017-18617 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.1.6 Description: The issue allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to "admin/editusertag.php", related to the CreateTagFunction and CallUserTag functions. The...

CVE-2017-3888

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability affects...

SA138 : OS Command Injection Vulnerability in ASG and CA

SUMMARY The ASG and CA web-based management consoles are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges. AFFECTED PRODUCTS Advanced Secure Gateway ASG --- CVE | Affected Releases |...

ZX_CSV Upload 1 – Authenticated SQL Injection

Type user access: admin user. $GET‘id’ is not escaped. URL is accessible for every registered user. 1 – Login with admin user. 2 - Send request post:...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

CVE-2016-0709

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

cPanel 5-9 Killacct Script Customer Account DNS Information Deletion Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by that administrator. This attack can...

Promise NAS NS4300N GUI bug

List, There is a bug in the Promise NAS NS4300N web GUI firmware version 1.1.0.5 which allows an authenticated admin user to change the password of the 'root' account. The user management portion of the web interface allows the admin user to change user's passwords. The PHP script that handles th...