27 matches found
CVE-2026-92609
A flaw was found in Apache Qpid Broker-J. The application does not renew session identifiers upon successful authentication, leading to a session fixation vulnerability in the HTTP management interface. A remote attacker can exploit this issue by establishing a session identifier prior to login a...
PT-2026-96078
Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.25.0 through 1.30.x Description An authenticated user with write permissions in a single namespace can trigger unauthorized administrative actions by exploiting how the server identifies internal Workflow completion...
EUVD-2026-45974
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...
CVE-2018-25321: Cross-Site Request Forgery (CSRF)
TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via...
CVE-2016-20054: Improper Neutralization of Input During Web Page Generation
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/usermanipulate and admin/settings/generall endpoints to...
CVE-2026-32839: Cross-Site Request Forgery (CSRF)
Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized administrative actions by inducing logged-in administrators to visit malicious pages. Attackers can exploit the lack of anti-CSRF tokens and...
CVE-2025-36410: Client-Side Enforcement of Server-Side Security
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
CVE-2023-53689: Improper Neutralization of Input During Web Page Generation
Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...
CVE-2024-39864
The CloudStack integration API service allows running its unauthenticated API server usually on port 8096 when configured and enabled via integration.api.port global setting for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is...
CVE-2024-31204
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...
CVE-2020-14275
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...
Siemens SCALANCE X-200, XR300-WG 3.0 and 3.1 RCDP Triggered Unauthorized Administrative Actions
Binary data 720205.prm...
CVE-2017-12736
After initial configuration, the Ruggedcom Discovery Protocol RCDP is still able to write to the device under certain conditions. This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions...
CVE-2017-12736
After initial configuration, the Ruggedcom Discovery Protocol RCDP is still able to write to the device under certain conditions. This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions...
CVE-2017-12736: Initialization of a Resource with an Insecure Default
After initial configuration, the Ruggedcom Discovery Protocol RCDP is still able to write to the device under certain conditions. This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions...
Siemens Ruggedcom WIN Vulnerability
OVERVIEW IOActive has coordinated with Siemens regarding multiple vulnerabilities in the Ruggedcom WIN firmware. Siemens has produced firmware updates that mitigates these vulnerabilities. These vulnerabilities could be exploited remotely if there is network access to the affected service. AFFECT...
GSC Client 1.00 2067 - Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/29718/info GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials. An attacker can exploit this vulnerability to perform unauthorized administrative...
WAGO Multiple Remote Vulnerabilities
WAGO is prone to multiple security vulnerabilities, including: 1. A security-bypass vulnerability 2. Multiple information-disclosure vulnerabilities 3. A cross-site request forgery vulnerability Successful attacks can allow an attacker to obtain sensitive information, bypass certain security...
GSC Client 1.00 2067 - Privilege Escalation
GSC Client 1.00 2067 - Privilege Escalation source: https://www.securityfocus.com/bid/29718/info GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials. An attacker can exploit this vulnerability to perform unauthorized...
GSC Client 1.00 2067 - Privilege Escalation
source: https://www.securityfocus.com/bid/29718/info GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials. An attacker can exploit this vulnerability to perform unauthorized administrative actions; other attacks are also...