2829 matches found
CVE-2023-20030 Cisco Identity Services Engine XML External Entity Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery SSRF attack through an affected device, or negatively impact the responsiveness of the...
GLPI 安全漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...
CVE-2023-20030 Cisco Identity Services Engine XML External Entity Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery SSRF attack through an affected device, or negatively impact the responsiveness of the...
PT-2023-3259 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.13 GLPI versions prior to 10.0.7 Description: The issue is related to a lack of authorization, allowing a user with the Technician profile to view and generate a personal token for a Super-Admin. This can be exploit...
PT-2023-17222 · Unknown · Thorsten/Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper privilege management, allowing any user who can add a new user to create a user with super admin rights. This has been fixed in version 3.1.12. Recommendation...
Researchers Detail Severe "Super FabriXss" Vulnerability in Microsoft Azure SFX
Details have emerged about a now-patched vulnerability in Azure Service Fabric Explorer SFX that could lead to unauthenticated remote code execution. Tracked as CVE-2023-23383 CVSS score: 8.2, the issue has been dubbed "Super FabriXss" by Orca Security, a nod to the FabriXss flaw CVE-2022-35829,...
Researchers Detail Severe "Super FabriXss" Vulnerability in Microsoft Azure SFX
Details have emerged about a now-patched vulnerability in Azure Service Fabric Explorer SFX that could lead to unauthenticated remote code execution. Tracked as CVE-2023-23383 CVSS score: 8.2, the issue has been dubbed "Super FabriXss" by Orca Security, a nod to the FabriXss flaw CVE-2022-35829,...
super-hobby.mt Cross Site Scripting vulnerability OBB-3240121
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
super-smash-flash-2.com Cross Site Scripting vulnerability OBB-3234897
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Stored XSS in front/dashboard_helpdesk.php
Description Under the super-admin view, when adding a card to a dashboard, some more parameters are sent when the POST request is made. Those parameters later constitute an HTML div section in the response body. It is possible to modify the request, inject one of those parameters value which will...
Annotation tool: token forgery using jwt secret to claim super admin role
Although the annotator tool's source code is not directly provided in the repository a docker image is provided. From there it is easy to get access to the source code by either extracting the docker tar image, which can be exported from docker itself, or connecting to the container with an...
superbikeuniverse.com Cross Site Scripting vulnerability OBB-3226960
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Authorization
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will...
WordPress Affiliate Super Assistent Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Affiliate Super Assistent Type Plugin Vulnerable versions = 1.5.1 Fixed in 1.5.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27417 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 77a6a8250831 Credits Mika...
CVE-2023-27088
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will...
CVE-2022-42476
A relative path traversal vulnerability CWE-23 in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via...
Protect
A relative path traversal vulnerability CWE-23 in FortiOS and FortiProxy may allow privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests...
Malicious code in py-intelcpusuper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 75269bcda9d04b6a1847b1dc769924ef11f30596c2ae06d1bf55081f12d96a31 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...
K15511932: F5 statement about Super Micro hardware compromise
Security Advisory Description F5 is aware of the reports of the alleged Super Micro Supermicro hardware compromise. F5 does not use Super Micro boards in any of our BIG-IP, BIG-IQ, Enterprise Manager, ARX, FirePass, or VIPRION hardware. F5 designs our own boards and controls the manufacturing tes...
