928 matches found
GHSA-F6XP-59JQ-R35C Phachon mm-wiki Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter...
PT-2023-11518 · Phachon · Mm-Wiki
Name of the Vulnerable Software and Affected Versions: Phachon mm-wiki version 0.1.2 Description: A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via the system/user/save parameter. Recommendations: For Phachon mm-wiki version 0.1.2, consider restricting acce...
Command injection
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" DUCC module of Apache UIMA, an authenticated user that has the permissions ...
Linux Kernel Use-After-Free Vulnerability
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user...
Book Store Management System 1.0.0 - Stored Cross-Site Scripting Vulnerability
Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting XSS Exploit Author: Rajeshwar Singh Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsmsci.zip Tested on: Windows/XAMPP Payload use...
Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)
Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting XSS Date: 2022-11-08 Exploit Author: Rajeshwar Singh Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsmsci.zip Tested on:...
CVE-2023-21456
Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uid...
CVE-2023-22883 Local Privilege Escalation in Zoom for Windows Installers
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to the SYSTEM user...
CVE-2023-22883 Local Privilege Escalation in Zoom for Windows Installers
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to the SYSTEM user...
Zoom Client 安全漏洞
Zoom Client is a video conferencing client application from Zoom Inc. that supports multiple platforms. A security vulnerability exists in Zoom Client for IT Admin Windows installers prior to version 5.13.5, which can be exploited by an attacker to elevate its privileges to a SYSTEM user during...
Oracle Database 19c Access Bypass Vulnerability
Oracle Database Vault had a flaw that would allow unauthorized privileged users to extract data from a protected table. Oracle 19c versions 19.18 and below are affected. Fixed in the Oracle Critical Patch Update October 2022. Title: Oracle Database Vault Protected Table With Realm Data Extraction...
Octobox 安全漏洞
Octobox is a tool for managing GitHub notifications. A security vulnerability exists in Octobox PR versions prior to 2807, which originates from a ReDoS vulnerability that can be triggered by a system user providing a specially crafted search query string...
Luckyframe SQL注入漏洞
LuckyFrame is a free and open source testing platform. A security vulnerability exists in Luckyframe v3.5, which originates from a SQL injection vulnerability in the dataScope parameter in /system/UserMapper.xml...
SUSE CVE-2018-8007
Apache CouchDB administrative users can configure the database server via HTTPS. Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user th...
SUSE CVE-2019-10164
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the...
The vulnerability of the Automation License Manager software lies in its external name management capabilities. This allows a perpetrator to rename and move files as a system user.
The vulnerability of the Automation License Manager software relates to external name management. Exploiting this vulnerability allows a malicious actor to rename and move files as a system user...
PT-2023-18781 · Splunk · Splunk Enterprise
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 Description: The issue allows any authenticated user to send an email as the Splunk instance through the "sendemai...
DataHub 授权问题漏洞
DataHub is datahub-project open source metadata platform for a modern data stack. DataHub is vulnerable to an authorization issue. An attacker exploiting this vulnerability could impersonate a system user account and perform any action on its behalf...
PT-2023-20156
Name of the Vulnerable Software and Affected Versions DataHub affected versions not specified Description The issue concerns the Metadata service GMS in DataHub, where the X-DataHub-Actor HTTP header is used to infer the user on whose behalf the frontend is sending a request. The header's name is...
PT-2023-12306 · Unknown · Jeecg-Boot
Name of the Vulnerable Software and Affected Versions: jeecg-boot versions 2.4.5 and earlier Description: The issue allows remote attackers to gain escalated privilege and view sensitive information. This is achieved via the API endpoint "/sys/user/querySysUser" with the username variable set to...