10019 matches found
CVE-2022-1298
The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
Unescaped control characters in Gitblit
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext '[email protected]\n\trole = "admin"' value...
CVE-2022-31267
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext '[email protected]\n\trole = "admin"' value...
CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
CVE-2022-29448
Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...
CVE-2021-36833
Authenticated admin or higher user role Stored Cross-Site Scripting XSS vulnerability in ibericode's MC4WP plugin = 4.8.6 at WordPress...
Hackers Gain Fileless Persistence on Targeted SQL Servers Using a Built-in Utility
Microsoft on Tuesday warned that it recently spotted a malicious campaign targeting SQL Servers that leverages a built-in PowerShell binary to achieve persistence on compromised systems. The intrusions, which leverage brute-force attacks as an initial compromise vector, stand out for their use of...
CVE-2022-30969
A cross-site request forgery CSRF vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator...
PicketLink does not properly check role based authorization
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...
GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...
GHSA-88F6-79X2-XQF3 Apache Jetspeed vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...
Cross-site Scripting (XSS)
Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the label value of an item or name of a role. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious...
com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0 <=1.0.1) potentially affected by CVE-2017-1000090 via org.jenkins-ci.plugins:role-strategy (=2.1.0)
org.jenkins-ci.plugins:role-strategy MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:role-strategy and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =1.0.1 Source...
CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...
GHSA-774G-R3FM-4V85 CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...
Improper Privilege Management in craftercms
A logged-in and authenticated user with a Reviewer Role may lock a content item...
GHSA-FJ9V-G8FW-VXMF Improper Privilege Management in craftercms
A logged-in and authenticated user with a Reviewer Role may lock a content item...
CVE-2021-23265
A logged-in and authenticated user with a Reviewer Role may lock a content item...
