275 matches found
CVE-2012-1563
Joomla! before 2.5.3 allows Admin Account Creation...
CVE-2019-16097:Harbor privilege elevation vulnerability alerts-a vulnerability alert-the black bar safety net
2019 9 May 19, 360CERT observed abroad security researcher Aviv Sasson found Harbor there is elevation of Privilege Vulnerability, the Harbor in the default configuration register the function is open, the attacker can register functions using the vulnerability to gain administrator privileges...
CVE-2019-11898
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition APE 3.8...
CVE-2019-9584
eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages...
CVE-2017-8230
On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" group and who has access to login in to the web administrativ...
CVE-2019-9958
The CVE-2019-9958 entry affects Quadbase EspressReport ES (ERES) v7.0 update 7, where a CSRF flaw in the admin panel allows remote attackers to escalate privileges or create new admin accounts by coercing an authenticated admin’s session to perform unintended requests. The vulnerability arises fr...
CVE-2018-17564
A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...
Cross site request forgery (csrf)
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040...
Cross site request forgery (csrf)
A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...
Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)
Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery Add Admin Title: Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery Add Admin Author: Gjoko 'LiquidWorm' Krstic @zeroscience Exploit Date: 2018-11-17 Vendor: Synaccess Networks Inc. Product web page:...
Remote Code Execution (RCE)
github.com/gogs/gogs is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the ability to forge a session-file in file.go, allowing unauthenticated users to obtain an admin session, and subsequently allowing remote code to be injected...
Design/Logic Flaw
IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998...
Time And Expense Management System 3.0 Cross Site Request Forgery
Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-17 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link: http://sourceforge.net/projects/tems/files/latest Version: 3.0 Category: Webapps Tested on:...
CVE-2018-16339
CVE-2018-16339 affects EmpireCMS 7.0 and is described as a Cross‑Site Request Forgery vulnerability that can add administrators via the endpoint upload/e/admin/user/AddUser.php?enews=AddUser. The connected documents confirm the affected product and the vulnerable action, but do not provide remedi...
Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)
Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Date: 2018-08-24 Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845...
CVE-2018-10592
Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could...
CVE-2018-1000506
Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...
PT-2018-3907 · Cisco · Cisco Fxos +2
Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software versions prior to the fixed version Cisco NX-OS Software versions prior to the fixed version Description: A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an...
SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change
SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on:...
