Trend Micro Password Manager vulnerable to privilege escalation

Overview Trend Micro Incorporated has released a security update for Trend Micro Password Manager. Trend Micro Incorporated reported the vulnerability to JPCERT/CC to notify users of the solutions through JVN. Impact A non-administrative user of the system where the affected product is installed...

Stored XSS

Description Stored XSS in ListAgenciaTransporte module in facturascripts is triggered when clicking the scrolling middle mouse button. Proof of Concept 1.Create a new non-admin account 2.Login and goto http://localhost/invoices/EditAgenciaTransporte 3.Add new user with website link to...

GHSA-M643-2PFV-XWM8 Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API

A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

GHSA-JWVR-VV7P-GPWQ Privilege escalation for users with create/update permissions in Global Roles in Rancher

Impact This vulnerability affects customers who utilize non-admin users that are able to create or edit Global Roles. The most common use case for this scenario is the restricted-admin role. A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and...

PT-2022-16916 · Minio +1 · Minio +1

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2022-04-12T06-55-35Z Description: A security issue was found in MinIO where a non-admin user can create service accounts for root or other admin users and then assume their access policies via the generated...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CockroachDB < 2.1.10 / 19.1.x < 19.1.16 / 19.2.x < 19.2.2 Broken Access Control Vulnerability (A42567)

The version of CockroachDB installed on the remote host has a privileged HTTP endpoint which is incorrectly available to non-admin users. An unauthenticated, remote attacker can exploit this issue by sending a specially crafted HTTP request to obtain & modify sensitive information from the remote...

CVE-2022-22948

CVE-2022-22948 affects VMware vCenter Server and is caused by improper default/file permissions that allow non-administrative access to disclose sensitive information. Public sources document VMSA-2022-0009, listing affected versions: vCenter 6.5 up to 6.5U3r, 6.7 up to 6.7U3p, and 7.0 up to 7.0U...

User Profile Arbitrary Junction Creation Local Privilege Elevation

The user profile service, identified as ProfSrv, is vulnerable to a local privilege elevation vulnerability in its CreateDirectoryJunction function due to a lack of appropriate checks on the directory structure of the junctions it tries to link together. Attackers can leverage this vulnerability ...

CVE-2021-40415

An incorrect default permission vulnerability exists in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. In cgicheckability the Format API does not have a specific case, the user permission will default to 7. This will give non-administrative users the...

CVE-2021-40415

CVE-2021-40415 concerns the Reolink RLC-410W (v3.0.0.136_20121102). The issue resides in the cgiserver.cgi function cgi_check_ability: several APIs (including most sensitive ones) have no explicit case, causing a default permission value of 7 to be applied. This allows a non-administrative (authe...

PT-2022-13089 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.11 Description: The issue is related to incorrect permission assignment for critical resources, allowing non-admin users to access sensitive information of other users. This is a case of improper...

CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

Cross-site Scripting (XSS) - Stored in admidio/admidio

Description When adding a menu after logging in with an administrator account, there is no verification of the URL value, so the XSS payload is stored in the DB. After that, when you click the saved menu, XSS is triggered. If an administrator adds a menu, normal users can click it too. Proof of...

CVE-2021-42956

Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dum...

CVE-2021-42956

Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dum...

ZOHO ManageEngine Remote Access Plus 安全漏洞

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. An information disclosure vulnerability exists in ZOHO ManageEngine Remote Access Plus Server prior to version 10.1.2132.6, which stems from a privilege management Improperly managed, the process will start as a...

PT-2021-4966

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions affected versions not specified VMware Cloud Foundation versions affected versions not specified Description The issue is related to a privilege escalation vulnerability in the IWA Integrated Windows Authenticati...

CVE-2021-41562

A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows...

CVE-2021-41562

A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows...