CVE-2020-7578

A vulnerability has been identified in Camstar Enterprise Platform All versions, Opcenter Execution Core All versions V8.2. Authenticated users could have access to resources they normally would not have. This vulnerability could allow an attacker to view internal information and perform...

Design/Logic Flaw

A vulnerability has been identified in Camstar Enterprise Platform All versions, Opcenter Execution Core All versions V8.2. Authenticated users could have access to resources they normally would not have. This vulnerability could allow an attacker to view internal information and perform...

CVE-2020-7578

A vulnerability has been identified in Camstar Enterprise Platform All versions, Opcenter Execution Core All versions V8.2. Authenticated users could have access to resources they normally would not have. This vulnerability could allow an attacker to view internal information and perform...

Siemens Opcenter Execution Core (Update B)

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Opcenter Execution Core --------- Begin Update B Part 1 of 5 --------- Vulnerabilities: Cross-site Scripting, SQL Injection, Improper Access Control, Insufficiently Protected...

CVE-2016-11077

An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...

Authorization

SAP NetWeaver AS ABAP Banking Services, versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user...

NukeViet VMS 4.4.00 - Cross-Site Request Forgery (Change Admin Password)

Exploit Title: NukeViet VMS 4.4.00 - Cross-Site Request Forgery Change Admin Password Date: 2020-05-18 Exploit Author: JEBARAJ Vendor Homepage: https://nukeviet.vn/ Software Link: https://github.com/nukeviet/nukeviet/releases/download/4.4.00/nukeviet4.4.00setup.zip Version: 4.4.00 Tested on:...

CVE-2020-0024

In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

Yershop Mall has a flawed logic vulnerability

Yershop online store management system is a mall system based on tp5.1 optimized version. Yershop Mall has a logic flaw vulnerability that can be exploited by an attacker to make unauthorized changes to any user name, resulting in the user not being able to log in to their account...

CVE-2020-7114

A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in ClearPass by crafting HTTP packets. As a result of this attack, a possible complete cluster compromise might occur. Resolution: Fixed in...

Real-Time Alerting and Incident Management for Unauthorized Changes

The security landscape is constantly changing, and you need to adopt proactive measures to stay ahead of security breaches by being extremely vigilant about every little change in your environment. In our previous blog, we discussed how you can leverage the ready-to-use monitoring profiles in you...

GitLab Insecure Privilege Vulnerability (CNVD-2020-19611)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.7...

Authentication flaw

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

Unspecified Vulnerability in Oracle Hyperion Financial Close Management

Oracle Hyperion is the United States Oracle Oracle company's set of financial modeling applications. The software provides financial settlement, report production and other functions. An unspecified vulnerability exists in Oracle Hyperion Financial Close Management. An attacker could exploit this...

Atlassian Jira Server and Data Center Authorization Issues Vulnerability (CNVD-2020-04825)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An authorization issue vulnerability exists in Atlassian Jira Server and Data Center. The vulnerability stems from a lack of...

Linux: SSH /etc/ssh/sshd_config chown

The /etc/ssh/sshdconfig file contains configuration specifications for sshd. This should be protected from unauthorized changes by non-privileged users. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or...

GitLab CE/EE Access Control Error Vulnerability (CNVD-2020-03780)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An access control error vulnerability exists in GitLab...

ASUS ZenFone 4 Selfie Access Control Error Vulnerability

The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker can...

Elephone A4 Access Control Error Vulnerability

Elephone A4 is a smartphone from China's ELEPHONE Communication Technology. An Access Control Error vulnerability exists in the Elephone A4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles and can be exploited b...

Unspecified Vulnerability in Doogee BL5000

Doogee BL5000 is a smartphone from Doogee, a Chinese company. A security vulnerability exists in the com.mediatek.factorymode app in the Doogee BL5000 build fingerprint: DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys. An attacker could use this vulnerability to make unauthorized...