PT-2023-11442 · Unknown · Searchblox

Name of the Vulnerable Software and Affected Versions: SearchBlox versions prior to 9.1 Description: The issue allows a user to bypass business logic and create multiple super admin users in the system. This can be exploited by manipulating the system's user creation mechanism. Recommendations: F...

Unauthorized Admin Transfer Vulnerability

Lines of code Vulnerability details Description The bug in this contract is that it doesn't handle the case when the pendingAdmin is set to the zero address address0. As per the condition msg.sender == address0, the if statement can be bypassed if an attacker sets pendingAdmin to the zero address...

CVE-2023-37917

KubePi Privilege Escalation vulnerability: a normal user can elevate privileges by editing the isadmin field in requests, gaining admin control. Root cause is improper authorization in user-create/update flow. Impact is administrative access with high confidentiality/integrity/availability concer...

PimpMyLog 1.7.14 Improper Access Control

Exploit Title: PimpMyLog v1.7.14 - Improper access control Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from...

PT-2023-5201 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM version 7.5.0 Description: The issue exists due to insufficient input validation, allowing a remote attacker to perform administrative actions. An authenticated user may be able to perform unauthorized actions. Recommendations...

CVE-2023-32465

Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access to the Cyber Recovery application. Exploitation may lead to complete system takeover by an attacker...

Osprey Pump Controller 跨站请求伪造漏洞

Osprey Pump Controller is a pump controller from Osprey. A security vulnerability exists in Osprey Pump Controller version 1.01. An unauthorized attacker could exploit this vulnerability to perform operations with administrative privileges...

Improper access control

Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup under a group for which the admin is not authorized...

CVE-2022-28173

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices...

CVE-2022-44037

An access control issue in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple...

CVE-2022-28169

Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to gain elevated admin rights, or privileges, beyond what is intended or entitled for that user. By exploiting this vulnerability, a user whose...

CVE-2022-20859

A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, and Cisco Unity Connection could allow an authenticated, remote attacker to perform certain administrative actions the...

PT-2022-3510 · Cisco · Cisco Unity Connection +2

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager versions affected versions not specified Cisco Unified Communications Manager IM & Presence Service versions affected versions not specified Cisco Unity Connection versions affected versions not specified...

PT-2022-15465 · Ibm · Ibm Spectrum Protect Operations Center +1

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.14.000 Description: The issue allows an attacker to exploit it using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server...

CVE-2022-22485

In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force...

CVE-2022-27629

Cross-site request forgery CSRF vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors...

CVE-2022-22294

A SQL injection vulnerability exists in ZFAKA=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account...

Cross site request forgery (csrf)

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...

IBM Ts7700 授权问题漏洞

The Ibm Ts7700 is a mainframe virtual tape solution from Ibm, Inc. for optimizing data security and business continuity. An authorization issue vulnerability exists in the IBM TS7700 Management Interface, which can be exploited by an attacker to gain administrative access to the Management...

CVE-2021-22729

A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker to...