UBUNTU-CVE-2018-16850

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges...

KLA11347 SB vulnerability in PostgreSQL

SQL injection vulnerability in PostreSQL. Malicious users can exploit this vulnerability via running arbitrary SQL statements with superuser privileges when a superuser runs pgupgrade on the database or during a pgdump dump/restore cycle to bypass security restrictions. Original advisories...

PostgreSQL -- SQL injection in pg_upgrade and pg_dump

The PostgreSQL project reports: CVE-2018-16850: SQL injection in pgupgrade and pgdump, via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can run arbitrary SQL statements with superuser privileges when a superuser runs pgupgrade on the database or during a...

CVE-2018-1822

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296...

CVE-2018-1822

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296...

PT-2018-14374

Name of the Vulnerable Software and Affected Versions IBM FlashSystem 900 product GUI affected versions not specified Description The issue allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password...

CVE-2018-1822: Improper Authentication

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296...

GHSA-X8F7-H444-97W4 The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

CVE-2018-1198

Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password...

Default credentials

Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password...

PT-2018-10929

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Cache versions prior to 1.3.1 Description The issue allows a malicious user with access to the logs to escalate their privileges using a superuser password printed in plain text during BOSH deployment logs. Recommendations For...

PT-2018-13853

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue in UCMS allows escalation from the normal user level of 1 to the superuser level of 3 due to mishandling of levels in the user/editpost.php file. Recommendations For UCMS version 1.4.6, consider...

CVE-2018-17037: Incorrect Permission Assignment for Critical Resource

user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3...

postgresql: Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database...

Design/Logic Flaw

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset...

CVE-2018-14801

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset...

CVE-2018-14801

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset...

CVE-2018-14801

CVE-2018-14801 affects Philips PageWriter TC10/TC20/TC30/TC50/TC70 Cardiographs. The vulnerability arises from hard-coded credentials allowing an attacker who has the superuser password and physical access to enter the superuser password and gain access to/modify all device settings, including re...

CVE-2018-14801: Use of Hard-coded Credentials

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset...