2305 matches found
CVE-2013-3703
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...
Design/Logic Flaw
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...
CVE-2013-3703 No write permission check in change_role command
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...
Red Hat oVirt Ansible Roles Information Disclosure Vulnerability
Red Hat oVirt is an open source virtualization management platform from Red Hat, an open source version of RHEV platform for enterprise virtualization that consists of an oVirt-node client and an overt-engine manager. ansible Roles is one of the components used to automate the configuration and...
IBM Security Guardium Big Data Intelligence Critical Resource Privilege Assignment Vulnerability
IBM Security Guardium Big Data Intelligence is a solution that delivers the capabilities of a big data platform while meeting data security requirements. IBM Security Guardium Big Data Intelligence SonarG suffers from an incorrect assignment of critical resource permissions vulnerability. An...
RHEL 7 : Virtualization (RHSA-2018:1452)
An update for ovirt-ansible-roles is now available for Red Hat Virtualization Engine 4.1. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities
Summary Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon 2.2.1. mmmagentd commonly runs with root privileges and does not require authentication by default. A specially crafted MMM protocol message can cause a...
Low: Red Hat Security Advisory: ovirt-ansible-roles security update
An update for ovirt-ansible-roles is now available for Red Hat Virtualization Engine 4.1. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
WordPress User Role Editor Plugin < 4.25 - Privilege Escalation Exploit
Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The WordPress...
WordPress Plugin User Role Editor 4.25 - Privilege Escalation
WordPress Plugin User Role Editor 4.25 - Privilege Escalation This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The...
Goddi (Go Dump Domain Info) - Dumps Active Directory Domain Information
Based on work from Scott Sutherland @nullbind, Antti Rantasaari, Eric Gruber @egru, Will Schroeder @harmj0y, and the PowerView authors. Install Use the executables in the releases section. If you want to build it yourself, make sure that your go environment is setup according to the Go setup doc...
Cross-site Request Forgery (CSRF)
kotti is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists when assigning local roles where a change in permission can occur in the /admin-document/@@share view request...
CVE-2018-9856
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
PYSEC-2018-10
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
PYSEC-2018-10
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
Cross site request forgery (csrf)
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
CVE-2018-9856
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...
CVE-2018-9856
Kotti vulnerability CVE-2018-9856 affects Kotti before 1.3.2 and 2.x before 2.0.0b2. The issue is CSRF in the local roles implementation, demonstrated by triggering a permission change via the /admin-document/@@share request. The connected sources explicitly identify the vulnerable component as t...
ProcessMaker - Plugin Upload Exploit
This Metasploit module will generate and upload a plugin to ProcessMaker resulting in execution of PHP code as the web server user. Credentials for a valid user account with Administrator roles is required to run this module. This Metasploit module has been tested successfully on ProcessMaker...
ProcessMaker - Plugin Upload (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ProcessMaker Plugin Upload', 'Description' = %q This module will generate and upload a plugin to ProcessMaker resulting in execution of PHP code a...