780 matches found
WordPress Baggage Freight Shipping Australia 0.1.0 Shell Upload
Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload Date: 2018-12-24 Software Link: https://wordpress.org/plugins/baggage-freight/ Exploit Author: Kaimi Website: https://kaimi.io Version: 0.1.0 Category: webapps Unrestricted file upload for unahtorized...
Design/Logic Flaw
All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations...
The vulnerability of network monitoring software for PRTG Network Monitor lies in the insecure management of privileges. This allows a malicious actor with the “read-only” privilege to create users with the “read-write” privilege.
The vulnerability of the network monitoring software PRTG Network Monitor relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, who has the “read-only” privilege, to create users with “read-write” privileges, including administrators, by using ...
Design/Logic Flaw
Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user...
CVE-2018-13355
CVE-2018-13355 affects TerraMaster TOS 3.1.03; a flawed access control in ajaxdata.php allows attackers to create user groups without proper authorization. This undermines integrity and could enable privilege elevation within the system. No remediation or patch details are provided in the connect...
CVE-2018-19545
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
CVE-2018-19545
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
Moderate severity vulnerability that affects org.apache.hive:hive-jdbc
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics...
CVE-2018-19411
PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account including administrator via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights...
Cross site request forgery (csrf)
PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account including administrator via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights...
Cross site request forgery (csrf)
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges including administrator. A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local...
CVE-2018-19332
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...
Cross site request forgery (csrf)
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...
CVE-2018-19332
CVE-2018-19332 affects S-CMS v1.5 and is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add endpoint. The CVE entry documents a cross-site request forgery flaw enabling unauthorized user creation, with CVSS data indicating a network-based, user-interaction-...
Improper access control
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perform unauthorized operations on the router...
CVE-2018-11785
Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query...
CVE-2018-18422
UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/aadminx.php?x=a URI...
Cross site request forgery (csrf)
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...