CVE-2018-14885

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

CVE-2018-14885

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

SuperDoctor5 - NRPE Remote Code Execution

SuperDoctor5 - NRPE Remote Code Execution SuperMicro implemented a Remote Command Execution plugin in their implementation of NRPE in SuperDocter 5, which is their monitoring utility for SuperMicro chassis'. This is an intended feature but leaves the system open by default to unauthenticated remo...

PT-2019-4485 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel version 5.0.21 Description: The issue is related to a use-after-free in the ext4 put super function in fs/ext4/super.c, which is connected to the dump orphan list function in the same file. This can occur when mounting a crafted...

Deserialization of untrusted data

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2018-10239

A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a...

CVE-2019-12868

CVE-2019-12868 (MISP 2.4.109) is a remote command execution vulnerability in the PHP component at app/Model/Server.php . The root cause is the use of PHP’s file_exists with user-controlled entries combined with phar:// URLs, which can trigger deserialization and allow a super administrator to exe...

Code injection

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

CVE-2019-12764

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

CVE-2019-12764

CVE-2019-12764 affects Joomla! prior to 3.9.7. The vulnerability is in the update server URL for component com_joomlaupdate, which can be manipulated by non Super-Admin users. Documented impact indicates potential integrity/confidentiality risk via update source redirection, but explicit exploita...

PT-2019-12931 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered where the update server URL of com joomlaupdate can be manipulated by non Super-Admin users. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later t...

Command Execution Vulnerability in the Backend of Super Star Huiya Digital Book Literature Service System

Beijing Century Super Star Information Technology Development Limited Liability Company Super Star is one of the companies engaged in the digitization of paper materials and the production of electronic publications. A command execution vulnerability exists in the backend of the Super Star Huiya...

Fortinet FortiGate <= 5.4.x / 5.6.x < 5.6.11 / 6.x < 6.2.0 Admin Privilege Escalation (FG-IR-17-053)

The remote host is running a FortiOS version prior or equal to 5.4.x or 5.6.x prior to 5.6.11 or 6.x to 6.2.0. It is, therefore, affected by an elevation of privilege vulnerability. An authenticated, remote attacker with admin privileges can exploit this, via restoring a modified configuration, t...

Code Execution Vulnerability in Super Cms Backend

Super CMS content management system in order to solve the problem of website optimization and development of a set of products, it is an efficient open source content management system, the product is based on PHP + MYSQL architecture, can run on Windows, Linux, MacOSX, Solaris and other various...

CVE-2018-18261

In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter...

Cross site scripting

In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter...

CVE-2018-18261

In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter...

CVE-2018-18261

CVE-2018-18261 affects waimai Super Cms 20150505. A Cross-Site Scripting (XSS) vulnerability exists via the /admin.php/Foodcat/addsave fcname parameter. The issue arises from improper handling/validation of input, allowing injected scripts to be reflected to users. References in Red Hat and NVD c...

[20190603] - Core - ACL hardening of com_joomlaupdate

The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

CVE-2017-17544

CVE-2017-17544 describes a privilege-escalation in Fortinet FortiOS where authenticated admin users can elevate themselves to super_admin by restoring a modified configuration. Affected FortiOS versions include 6.0.0–6.0.6, 5.6.0–5.6.10, and 5.4 and earlier. Connected sources corroborate that the...