Cisco Identity Services Engine Authentication Bypass Vulnerability

A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...

Cross-Site Scripting Vulnerability in LvyeCMS

LvyeCms 旅烨cms is a php content management system based on ThinkPHP. A cross-site scripting vulnerability exists in LvyeCMS. The vulnerability stems from the system not strictly filtering the backend parameters. An attacker can obtain super admin login privileges by constructing a specially crafte...

PT-2017-2887

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine versions 1.3, 1.4, 2.0.0, 2.0.1, 2.1.0 Cisco ISE Express versions 1.3, 1.4, 2.0.0, 2.0.1, 2.1.0 Cisco ISE Virtual Appliance versions 1.3, 1.4, 2.0.0, 2.0.1, 2.1.0 Description A vulnerability in the authentication...

Mao10CMS user_register.php 添加超级管理员逻辑漏洞

No description provided by source...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

UBUNTU-CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

CVE-2015-7685

CVE-2015-7685 affects GLPI before 0.85.3. A remote authenticated user can escalate privileges by abusing the create user path and the _profiles_id parameter in front/user.form.php to create a super-admin account. The root cause is improper handling of permissions when creating users via that form...

CVE-2015-7685: Undefined Security Weakness

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

PT-2015-7579

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.3 Description The issue allows remote authenticated users to create super-admin accounts. This is achieved by leveraging permissions to create a user and the profiles id parameter to the "front/user.form.php"...

MGASA-2015-0204 Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

PT-2015-7902

Name of the Vulnerable Software and Affected Versions glpi affected versions not specified Description The issue allows any user with the rights to create a new user to create a super-admin user. Recommendations At the moment, there is no information about a newer version that contains a fix for...

GLPI 0.85.2 Shell Upload / Privilege Escalation

Multiple vulnerabilities have been identified in GLPI http://www.glpi-project.org. 1/ Arbitrary file upload Severity: Important Versions Affected =========== All versions between 0.85 and 0.85.2 Description ======= When an user wants to create a new ticket, he has the possibility to add an...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

DEBIAN-CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...