306 matches found
The vulnerability of the remote execution service for the “Scanner-VS” security scanner allows access to the security scanner with superuser privileges.
The vulnerability of the remote execution service of the “Scanner-VS” security scanner is related to the presence of a pre-installed administrative account, whose information is not available in the documentation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...
PT-2019-11636 · Postgresql Global Development Group · Postgresql
Name of the Vulnerable Software and Affected Versions: Postgresql versions prior to 11.5 Postgresql versions prior to 10.10 Postgresql versions prior to 9.6.15 Postgresql versions prior to 9.5.19 Postgresql versions prior to 9.4.24 Description: The issue allows a superuser to write a password to ...
IBM Sterling Connect:Direct Elevation of Privilege Vulnerability
IBM Sterling Connect:Direct is a file-based peer-to-peer file transfer solution from IBM in the United States. An elevation of privilege vulnerability exists in IBM Sterling Connect:Direct for UNIX versions 6.0.0, 4.3.0, and 4.2.0 for UNIX-based platforms, which can be exploited by an attacker to...
CVE-2019-9193
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...
UBUNTU-CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges...
The installation wizard in DotNetNuke (DNN) allows privilege escalation
The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...
GHSA-X8F7-H444-97W4 The installation wizard in DotNetNuke (DNN) allows privilege escalation
The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...
postgresql: Uncontrolled search path element in pg_dump and other client applications
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database...
Design/Logic Flaw
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset...
CVE-2018-5342
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...
ALPINE-CVE-2018-1058
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected...
Enlarge your botnet with: top D-Link routers (DIR8xx D-Link routers cruisin' for a bruisin')
In this article, we are going to discuss vulnerabilities detected in the top D-Link routers: DIR890L DIR885L DIR895L and other DIR8xx D-Link routers cruising for a bruising. The devices use the same code, thus giving a magnificent and quite tempting opportunity to attackers to add them to a botne...
The vulnerability of the Cisco Elastic Services Controllers network management interface, related to errors in managing registration data, allows a perpetrator to gain access to the system with superuser privileges.
The vulnerability of the Cisco Elastic Services Controllers network management interface is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the system with superuser privileges...
CVE-2017-7220
OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...
CVE-2017-7220
OpenText Documentum Content Server has a vulnerability where an attacker can gain superuser access by saving a crafted object via sys_obj_save (or saving an object) and issuing an unauthorized UPDATE dm_dbo.dm_user_s SET user_privileges=16, i.e., the so‑called RPC save-commands attack. This CVE (...
CVE-2017-7220
OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...
CVE-2017-7220: Improper Input Validation
OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...
DotNetNuke Security Bypass Vulnerability
DotNetNuke DNN is a set of U.S. DNN company supported by Microsoft, based on the ASP.NET platform for open source content management system CMS. A security vulnerability exists in the installationwizard in versions of DNN prior to 7.4.1. A remote attacker can exploit the vulnerability by sending ...
Design/Logic Flaw
The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...