Cisco Smart Software Manager 安全漏洞

Cisco Smart Software Manager is the United States Cisco Cisco company for the provision of license intelligent management features of the software. The software eliminates cumbersome product activation key PAK and license file management, so that the license node is no longer locked to the device...

Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

Description Missing CSRF token in role stage assignment, save language settings, and task notification 1: http://10.0.2.15/index.php/e/$$$call$$$/grid/settings/roles/user-group-grid/unassign-stage?stageId=1&userGroupId=5 2:...

CVE-2021-36877 WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WordPress uListing plugin versions = 2.0.5 makes it possible for attackers to modify user roles...

Cross-Site Request Forgery (CSRF) in neorazorx/facturascripts

✍️ Description Attacker able to change any role with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...

Design/Logic Flaw

Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to perform actions not belonging to his role...

CVE-2021-33327

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibilit...

CVE-2021-33327

The CVE-2021-33327 entry documents an access control flaw in the Portlet Configuration module of Liferay Portal 7.2.0–7.3.3 and Liferay DXP 7.0 fix pack 93–94, 7.1 fix pack 18, and 7.2 before fix pack 8. The vulnerability allows remote authenticated users to view the Guest and User roles even whe...

Cross site scripting

The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still...

Improper Privilege Management in uvdesk/core-framework

✍️ BUG privilege escalation bug to pin a threads 🕵️‍♂️ Proof of Concept 1. Frist from admin account goto http://localhost/uvdesk/public/en/member/agents and add new user called user B with Agent role .\ Now gives user-B all tikceting permission like can update/add/edit/delete/lock/pin to a ticket...

GHSA-5PR9-V234-JW36 Remote Code Execution via traversal in TAL expressions

Impact Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python...

GHSA-962M-M8JW-8WRR Duplicate Advisory: Path Traversal in Zope

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5pr9-v234-jw36. This link is maintained to preserve external references. Original Description Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted...

Prisma Cloud Compute: User role authorization secret for Console leaked through log file export

An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log...

Stock in & out <= 1.0.4 - Authenticated SQL Injection

The plugin lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability. PoC...

CVE-2021-32633 Remote Code Execution via traversal in TAL expressions

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites...

CVE-2021-25931

CVE-2021-25931 describes a CSRF vulnerability in OpenNMS Horizon (opennms-1-0-stable up to 27.1.0-1) and OpenNMS Meridian (meridian-foundation-2015.1.0-1 to 2020.1.6-1) where there is no CSRF protection for the endpoint /opennms/admin/userGroupView/users/updateUser. The flaw enables an attacker t...

Design/Logic Flaw

A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.19, Mendix Applications using Mendix 8 All versions V8.17.0, Mendix Applications using Mendix 8 V8.12 All versions V8.12.5, Mendix Applications using Mendix 8 V8.6 All versions V8.6.9, Mendix Applications...

Siemens Mendix Elevation of Privilege Vulnerability

Siemens Mendix is a low-code application development platform from Siemens. The platform provides application development, testing, deployment and iteration. An elevation of privilege vulnerability exists in Siemens Mendix. An attacker could use the vulnerability to gain administrative privileges...

Privilege Escalation

apacheairflow is vulnerable to privilege escalation. Users with Viewer or User role are able to access sensitive information as it does not enforce a proper access control on Configurations Endpoint for the Stable API even if webserver exposeconfig is set to False in airflow.cfg...

CVE-2021-24158

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2021-24158

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...