Sentrifugo 3.2 - Persistent Cross-Site Scripting

Sentrifugo 3.2 - Persistent Cross-Site Scripting Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting Google Dork: N/A Date: 8/29/2019 Exploit Author: creosote Vendor Homepage: http://www.sentrifugo.com/ Version: 3.2 Tested on: Ubuntu 18.04 CVE : CVE-2019-15814 Multiple Stored XSS...

Sentrifugo 3.2 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting Exploit Author: creosote Vendor Homepage: http://www.sentrifugo.com/ Version: 3.2 Tested on: Ubuntu 18.04 CVE : CVE-2019-15814 Multiple Stored XSS vulnerabilities were found in...

CVE-2018-15513

CVE-2018-15513 affects totemomail 6.0.0 build 570 where the log viewer API/feature enables access to session IDs of high-privilege users by abusing access granted to a read-only auditor role. The underlying cause is not detailed beyond this access path; the impact is exposure of sensitive session...

CVE-2018-15513

Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor role...

Design/Logic Flaw

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...

CVE-2019-11247

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...

CVE-2019-11247 Kubernetes kube-apiserver allows access to custom resources via wrong scope

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...

CVE-2019-11247

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 10 (2.5.0-1691)

This update provides fixes and improvements. Vulnerability id: VSTOR-22386, VSTOR-24775, VSTOR-25752 Upgrade Improvements in iSCSI targets migration during upgrade. Vulnerability id: VSTOR-25072 Upgrade Improved upgrade speed. Vulnerability id: VSTOR-25784 Upgrade Unable to download upgrade as a...

WordPress user-role plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. user-role is a plug-in for website user management. A cross-site scripting vulnerability exists in the WordPress user-role plugin...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

Cross site scripting

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The CVE-2017-18566 affects the WordPress plugin “user-role” by BestWebSoft, specifically versions before 1.5.6. The connected data confirms multiple XSS vulnerabilities (CWE-79) in this plugin, with practical impact: authenticated attackers can inject and execute arbitrary JavaScript in victims’ ...

The vulnerability of the Role-Based Access Control (RBAC) implementation for Etcd configuration storage allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Role-Based Access Control RBAC implementation for the Etcd configuration store is related to authentication errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a request via the...

CVE-2019-1229

An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation. To exploit this vulnerability, an attacker...

PT-2019-12735 · Microsoft · Dynamics On-Premise

Name of the Vulnerable Software and Affected Versions: Dynamics On-Premise version 9 Description: An elevation of privilege issue exists, allowing an attacker to gain control of the Web Role hosting the Dynamics installation by leveraging a customizer privilege within Dynamics. To exploit this, a...

Dynamics On-Premise Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation. To exploit this vulnerability, an attacker...

scienpress.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-930700 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting scienpress.com website and...