4668 matches found
PYSEC-2019-15
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...
PYSEC-2019-15
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...
PYSEC-2019-85
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...
PT-2019-15772
Name of the Vulnerable Software and Affected Versions Django versions 2.1 through 2.1.14 Django versions 2.2 through 2.2.7 Description The issue allows unintended model editing in certain configurations. When a Django model admin displays inline related models and the user has view-only permissio...
Django -- multiple vulnerabilities
Django release reports: CVE-2019-19118: Privilege escalation in the Django admin. Since Django 2.1, a Django model admin displaying a parent model with related model inlines, where the user has view-only permissions to a parent model but edit permissions to the inline model, would display a...
Custom Header - Automatic Add New Header To Entire BurpSuite HTTP Requests
This Burp Suite extension allows you to customize header with put a new header into HTTP REQUEST BurpSuite Scanner, Intruder, Repeater, Proxy History and also you can choose whatever HTTP VERB what do you want to customize. Usage Easy to use ! : Don't forget to click save button ! Changelog 24...
CVE-2019-15333
The CVE-2019-15333 issue affects Lava Flair Z1 (build LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys). A pre-installed app (com.android.lava.powersave, versionCode 400, versionName v4.0.27) exposes an exported interface that allows any co-located app to programmatically disable and enable W...
CVE-2019-16210
Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save...
Default credentials
Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save...
November 5, 2019, update for Access 2016 (KB4475539)
None None...
BSA-2019-869
Security Advisory ID : BSA-2019-869 Component : SANnav Revision : 1.0 An information exposure vulnerability, in Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save. The vulnerability could allow an authenticated local malicious user with...
CVE-2019-17553
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI...
vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution
?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability --------------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail................:...
CVE-2019-15635
An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...
UBUNTU-CVE-2019-15635
An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...
CVE-2016-10974
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frssave CSRF with resultant stored XSS...
CVE-2016-10968
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax-save privilege escalation...
WordPress wp-private-content-plus plugin unauthorized operation vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-private-content-plus is a plugin for restricting access to website content. A security vulnerability exists in WordPress...