18949 matches found
CVE-2020-12101
The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address...
CVE-2019-16653
An application plugin in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to gain admin privileges...
CVE-2019-16653
An application plugin in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to gain admin privileges...
CVE-2019-16652
The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...
CVE-2019-16652
The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...
CVE-2019-16653
An application plugin in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to gain admin privileges...
CVE-2019-16652
The CVE-2019-16652 entry concerns Genius Bytes Genius Server (Genius CDDS) BPM component, version 3.2.2, where remote authenticated users can execute arbitrary commands. Multiple connected sources (CNVD-2020-27220; RH: CVE-2019-16652; NVD; CVE records) corroborate that a code/injection-style path...
CVE-2020-5570
Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2020-5570
Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2020-5570
CVE-2020-5570 affects Sales Force Assistant (versions 11.2.48 and earlier). The vulnerability is a cross-site scripting (CWE-79) issue that allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Documented impact indicates arbitrary script execution ...
CVE-2020-5565
Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's data via the applications 'Workflow' and 'MultiReport'...
CVE-2020-5566
Improper authorization vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to alter the application's data via the applications 'E-mail' and 'Messages'...
CVE-2020-5350
Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...
CVE-2020-5350
Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...
Design/Logic Flaw
An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...
CVE-2020-9004
CVE-2020-9004 describes a remote authenticated authorization-bypass in Wowza Streaming Engine (versions 4.8.0 and earlier) where a read-only user could issue requests to the admin panel to change functionality, including activating the Java JMX port in unauthenticated mode and executing OS comman...
CVE-2020-9004
A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and...
WordPress Plugin Media Library Assistant 2.81 - Local File Inclusion
Exploit Title: Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion Google Dork: N/A Date: 2020-04-13 Exploit Author: Daniel Monzón stark0de Vendor Homepage: http://davidlingren.com/ Software Link: https://wordpress.org/plugins/media-library-assistant/ Version: 2.81 Tested on:...
