CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-35957

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-35957: Authentication Bypass by Spoofing

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-30670 Escalate Privileges to Server Admin - Robohelp Server

RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An authenticated attacker could leverage this vulnerability to achieve full administrator privileges. Exploitation of this issue does not require...

Talariax sendQuick Alertplus Server Admin 4.3 SQL Injection

Dear Full Disclosure Team, We are writing to submit a full disclosure for the following vulnerability discovered for product Talariax sendQuick Alertplus server admin version 4.3. This is an updated reference for https://seclists.org/fulldisclosure/2021/Oct/1...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

CVE-2021-26795 affects TalariaX SendQuick Alert Plus Server Admin 4.3 (prior to 8HF11). The vulnerability is a SQL Injection in /appliance/shiftmgn.php due to insufficient input filtering/escaping, allowing an attacker to obtain sensitive information via Roster Time to Roster Management. Fixed in...

TalariaX Pte Ltd Talariax SendQuick Alertplus Server Admin SQL注入漏洞

TalariaX Pte Ltd Talariax SendQuick Alertplus Server Admin is a server management system of TalariaX Pte Ltd, Singapore. versions prior to 4.3 8HF11, a security vulnerability exists in the software where /appliance/shiftmgn.php lacks effective filtering and escaping of user submitted SQL...

CVE-2021-26795: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

PT-2021-17136

Name of the Vulnerable Software and Affected Versions TalariaX sendQuick Alert Plus Server Admin version 4.3 before 8HF11 Description A SQL Injection issue in the /appliance/shiftmgn.php endpoint allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-22707

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

CVE-2021-25775

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users...

PT-2021-16787

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2020.2.1 Description The issue allows a server admin to create and see access tokens for any other users. Recommendations For versions prior to 2020.2.1, update to version 2020.2.1 or later to resolve the...

CVE-2021-25775: Undefined Security Weakness

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users...

Memory corruption vulnerability exists in WPS Office International Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-41837)

Kingsoft WPS is Kingsoft Office Software office software, you can realize the office software commonly used text, forms, presentations and other functions. Zhuhai Kingsoft Office Software Co., Ltd. WPS Office international version of the existence of memory corruption vulnerability, attackers can...

Code execution vulnerability exists in ESPCMS (CNVD-2020-32575)

ESPCMS is a free and professional enterprise website building system. A code execution vulnerability exists in ESPCMS, which can be exploited by attackers to execute malicious code and obtain server administrative privileges...