517 matches found
[20190603] - Core - ACL hardening of com_joomlaupdate
The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...
CVE-2017-17544
CVE-2017-17544 describes a privilege-escalation in Fortinet FortiOS where authenticated admin users can elevate themselves to super_admin by restoring a modified configuration. Affected FortiOS versions include 6.0.0–6.0.6, 5.6.0–5.6.10, and 5.4 and earlier. Connected sources corroborate that the...
CVE-2018-15459 Cisco Identity Services Engine Privilege Escalation Vulnerability
A vulnerability in the administrative web interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could explo...
CVE-2018-20226
An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...
WUZHI CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-09137)
WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS 4.1.0 exists cross-site request forgery vulnerability, an attacker can change the super administrator's username via index.php?m=core&f=panel&v=editinf to take advantage of this...
ASP4CMS AspCMS Elevation of Privilege Vulnerability
ASP4CMS AspCMS is China's ASP4CMS open source laboratory of a free enterprise website construction system . The system supports customized templates and plug-in extensions and other features. ASP4CMS AspCMS 2.5.6 version of a security vulnerability , the vulnerability stems from the /member/reg.a...
Information disclosure
An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside the web application permits an unauthenticated user to bypass the login screen and access the webcam contents including: live video stream, configuration file...
CVE-2017-17101
An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside the web application permits an unauthenticated user to bypass the login screen and access the webcam contents including: live video stream, configuration file...
CVE-2017-7738
An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...
The vulnerability of the authentication module of the Cisco Identity Services Engine allows a hacker to gain Super Admin privileges for the ISE Admin portal.
The vulnerability of the Cisco Identity Services Engine’s authentication module arises from incorrect processing of authentication requests and improper determination of security policies for users who have passed the verification. Exploiting this vulnerability can allow a malicious actor,...
CVE-2015-3657
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privileges via unspecified vectors...
CVE-2015-3657
The CVE-2015-3657 entry concerns Aruba Networks ClearPass Policy Manager. Affected versions are CPPM before 6.4.7 and 6.5.x before 6.5.2. A remote attacker who is an authenticated lower‑level administrator can escalate to Super Admin privileges via unspecified vectors. The vulnerability is descri...
CVE-2017-6747
A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...
CVE-2017-6747
A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...
CVE-2017-6747
Cisco Identity Services Engine (ISE) and related appliances (ISE Express and ISE Virtual Appliance) are affected by CVE-2017-6747, a unauthenticated remote authentication bypass vulnerability in the authentication module. The issue arises from improper handling of authentication requests and poli...
Cisco Identity Services Engine Authentication Bypass Vulnerability (cisco-sa-20170802-ise)
A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...
Cisco Identity Services Engine Authentication Bypass Vulnerability
A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...
Cross-Site Scripting Vulnerability in LvyeCMS
LvyeCms 旅烨cms is a php content management system based on ThinkPHP. A cross-site scripting vulnerability exists in LvyeCMS. The vulnerability stems from the system not strictly filtering the backend parameters. An attacker can obtain super admin login privileges by constructing a specially crafte...
