4718 matches found
CVE-2020-0665
An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...
CVE-2019-19660
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html...
Cross site request forgery (csrf)
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html...
CVE-2019-19660
The CVE-2019-19660 entry concerns a CSRF vulnerability in the Web File Manager’s Network Settings of Rumpus FTP Server 8.2.9.1 . The issue allows an attacker to manipulate settings such as the SMTP value and other network parameters via RAPR/NetworkSettingsSet.html . Affected component is the Web...
CVE-2019-19660
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html...
CVE-2019-19660: Cross-Site Request Forgery (CSRF)
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html...
PT-2020-10207
Name of the Vulnerable Software and Affected Versions Rumpus FTP Server version 8.2.9.1 Description A CSRF issue exists in the Web File Manager's Network Setting functionality. This allows an attacker to manipulate the SMTP setting and other network settings via the "RAPR/NetworkSettingsSet.html"...
MGASA-2020-0081 Updated sudo packages fix security vulnerability
The updated packages fix a security vulnerability: In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for...
PT-2020-7622
Name of the Vulnerable Software and Affected Versions UniFi Controller versions prior to 3.2.1 Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including creating a new admin user, changing guest settings, blocking or unblocking...
UBUNTU-CVE-2020-8632
In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...
CVE-2019-15617
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...
Unrestricted upload of file with dangerous type in Apache Solr
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLEREMOTEJMXOPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and...
GHSA-2289-PQFQ-6WX7 Unrestricted upload of file with dangerous type in Apache Solr
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLEREMOTEJMXOPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and...
Security Bulletin: WebSphere Application Server improper cookie setting vulnerability affects IBM Control Center (CVE-2019-4305)
Summary WebSphere Application Server in IBM Control Center could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to...
Linux: SSH DenyUsers
The DenyUsersvariable gives the system administrator the option of denying specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specificall...
jenkins: XSS vulnerability in Jenkins URL setting
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission...
PT-2020-18977
Name of the Vulnerable Software and Affected Versions Minimal Coming Soon & Maintenance Mode versions 2.10 and earlier Description A flaw in the Minimal Coming Soon & Maintenance Mode plugin allows a CSRF attack, enabling an attacker to enable maintenance mode, inject XSS, modify important...
WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - CSRF to Stored XSS and Setting Changes vulnerability
CSRF to Stored XSS and Setting Changes vulnerability found by Chloe Chamberland in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...
Minimal Coming Soon & Maintenance Mode < 2.15 - CSRF to Stored XSS and Setting Changes
This plugin had no nonce checks on any of the settings to verify that a request came from a legitimate source, such as a logged in administrative user. Therefore, creating a CSRF to stored XSS in addition to significant setting changes. alert1" /...
Minimal Coming Soon & Maintenance Mode < 2.15 - CSRF to Stored XSS and Setting Changes
This plugin had no nonce checks on any of the settings to verify that a request came from a legitimate source, such as a logged in administrative user. Therefore, creating a CSRF to stored XSS in addition to significant setting changes. PoC...