780 matches found
Security Bulletin: MQSISTOP/STARTMSGFLOW commands with unauthorized user succeed affects IBM WebSphere Message Broker and IBM Integration Bus (CVE-2015-5011)
Summary MQSISTOP/STARTMSGFLOW commands with unauthorized user succeed affecting IBM WebSphere Message Broker and IBM Integration Bus Vulnerability Details CVEID: CVE-2015-5011 DESCRIPTION: IBM Integration Bus could allow a local user to start and stop a service that they should not have access to...
CVE-2020-9018
LiteCart through 2.2.1 allows admin/?app=users&doc=edituser CSRF to add a user...
Cross site request forgery (csrf)
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...
Code injection
IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server possibly leading to an effective denial of service or disabling of the monitoring server. IBM X-Force ID: 167647...
Starbucks: Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks card
nnez discovered that a hacker could transfer funds from one Starbucks card to another by inspecting the form with Google Chrome DevTools and then change the forms "CardNumber" value to a victim's valid Starbucks card number. If the value entered for the "FullAmount" form field did not exceed the...
Global Management System (GMS) Unauthorized User SQL Injection
A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1. CVE: CVE-2019-7478 Last updated: Dec. 30, 2019, 8 p.m...
CVE-2019-19743
On D-Link DIR-615 devices, a normal user is able to create a rootadmin user from the D-Link portal...
CVE-2019-15815
ZyXEL P-1302-T10D v3 devices with firmware version 2.00ABBX.3 and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges...
CVE-2013-1811
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...
CVE-2019-12147
The Sangoma Session Border Controller SBC 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to th...
Cross site request forgery (csrf)
app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI...
About the security content of iCloud for Windows 7.5 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...
CVE-2019-4227
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 159352...
Session fixation
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 159352...
CVE-2019-4227
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 159352...
CVE-2019-4227
CVE-2019-4227 affects IBM MQ AMQP Listeners across multiple releases (8.0.0.4–8.0.0.12; 9.0.0.0–9.0.0.6; 9.1.0.0–9.1.0.2; 9.1.0–9.1.2). The issue allows an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. Public details confirm the root ...
CVE-2019-16706
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cmsuseradd.php...
CVE-2019-6789
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 4 of 6. In some cases, users without project permissions will receive emails after a project move. For private projects, this wi...
Information disclosure
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 4 of 6. In some cases, users without project permissions will receive emails after a project move. For private projects, this wi...
