CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

PT-2018-3100

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 and earlier Description The issue is related to improper privilege management, which may allow an attacker to access files and perform actions at a system administrator level. This could enable an attacker to...

CVE-2018-14828: Improper Privilege Management

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

The bundled Atlassian Universal Plugin Manager plugin had a XXE issue - CVE-2018-20233

The version of the bundled Atlassian Universal Plugin Manager plugin had a XML External Entity vulnerability that allowed remote attackers with system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in t...

The bundled Atlassian Universal Plugin Manager plugin had a XXE issue - CVE-2018-20233

The version of the bundled Atlassian Universal Plugin Manager plugin had a XML External Entity vulnerability that allowed remote attackers with system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in t...

CVE-2016-9498 ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects

ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application...

PT-2018-5088

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 through 13 before build 13200 Description The issue allows unserialization of unsafe Java objects, which can be exploited by a remote user without authentication. This enables the execution of remo...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files (CVE-2015-7487)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files. Vulnerability Details CVEID: CVE-2015-7487 DESCRIPTION: IBM Maximo Asset Management contains a vulnerability which...

The vulnerability of the executable file DTISQLInstaller.exe of the software package for interacting with QuicDoc and Office Therapy clients allows a perpetrator to gain access to the software.

The vulnerability of the DTISQLInstaller.exe executable file of the software package for interacting with QuicDoc and Office Therapy clients is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the softwar...

Kaseya Virtual System Administrator agent local elevation of privilege vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms from Kaseya, Switzerland, for simplifying and automating IT services, of which the Kaseya Virtual System Administrator agent is an agent program. A security vulnerability exists in Kaseya Virtual System Administrator...

Race condition

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

Kaseya VSA Agent

PT-2018-5398

Name of the Vulnerable Software and Affected Versions: Kaseya Virtual System Administrator versions 9.3.0.11 and earlier Description: The issue is related to a Time of Check & Time of Use TOCTOU vulnerability. This vulnerability can be exploited by winning a race condition when the Kaseya Virtual...

CVE-2017-12410: Concurrent Execution using Shared Resource with Improper Synchronization

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

Privilege Escalation

github.com/tridentli/pitchfork is vulnerable to privilege escalation. The vulnerability exists due to an issue where permissions are mapped, allowing any authenticated user to set the System Administrator permissions on their account...

Design/Logic Flaw

Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to...

CVE-2018-1000133: Improper Privilege Management

Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to...

PT-2018-9307

Name of the Vulnerable Software and Affected Versions: Pitchfork version 1.4.6 RC1 Description: The issue is related to improper privilege management in Trident Pitchfork components, allowing a standard unprivileged user to gain system administrator permissions within the web portal. This can be...