CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-35957: Authentication Bypass by Spoofing

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-30670 Escalate Privileges to Server Admin - Robohelp Server

RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An authenticated attacker could leverage this vulnerability to achieve full administrator privileges. Exploitation of this issue does not require...

Talariax sendQuick Alertplus Server Admin 4.3 SQL Injection

Dear Full Disclosure Team, We are writing to submit a full disclosure for the following vulnerability discovered for product Talariax sendQuick Alertplus server admin version 4.3. This is an updated reference for https://seclists.org/fulldisclosure/2021/Oct/1...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-26795

CVE-2021-26795 affects TalariaX SendQuick Alert Plus Server Admin 4.3 (prior to 8HF11). The vulnerability is a SQL Injection in /appliance/shiftmgn.php due to insufficient input filtering/escaping, allowing an attacker to obtain sensitive information via Roster Time to Roster Management. Fixed in...

CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

TalariaX Pte Ltd Talariax SendQuick Alertplus Server Admin SQL注入漏洞

TalariaX Pte Ltd Talariax SendQuick Alertplus Server Admin is a server management system of TalariaX Pte Ltd, Singapore. versions prior to 4.3 8HF11, a security vulnerability exists in the software where /appliance/shiftmgn.php lacks effective filtering and escaping of user submitted SQL...

CVE-2021-26795: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-22707

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

CVE-2021-25775

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users...

CVE-2021-25775: Undefined Security Weakness

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users...

Memory corruption vulnerability exists in WPS Office International Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-41837)

Kingsoft WPS is Kingsoft Office Software office software, you can realize the office software commonly used text, forms, presentations and other functions. Zhuhai Kingsoft Office Software Co., Ltd. WPS Office international version of the existence of memory corruption vulnerability, attackers can...

Code execution vulnerability exists in ESPCMS (CNVD-2020-32575)

ESPCMS is a free and professional enterprise website building system. A code execution vulnerability exists in ESPCMS, which can be exploited by attackers to execute malicious code and obtain server administrative privileges...

Extreme CMS suffers from a file upload vulnerability (CNVD-2020-32574)

Extreme CMS is an open source and free PHP web content management system. Extreme CMS has a file upload vulnerability that can be exploited by attackers to upload malicious files and obtain server administrative privileges...

EyouCms suffers from a file upload vulnerability (CNVD-2020-25554)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework as the core development. EyouCms file upload vulnerability, attackers can use the vulnerability to upload malicious files to obtain server administrative privileges...

Extreme Office 2019 suffers from a code execution vulnerability (CNVD-2020-28017)

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. Extreme Office 2019 suffers from a code execution vulnerability that can be exploited by an attacker to obtain web server administrative privileges using a carefully constructe...

CVE-2016-4315: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxyajaxprocessor.jsp...