PT-2019-14769 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 9.0.5 Description: The issue allows for stored XSS via the User Group Description section in card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script, potentially achieving...

CVE-2019-11363

A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGroupQuery.php ShowUser parameter...

Time logged shown on Activity Stream gadget.

h3. Summary When using a group comment visibility on worklogs the restriction is not applied in the Activity Stream and this shows the time logged by a user even if the user that is logged in is not part of the group. h3. Steps to Reproduce Set up a test user JIRA Users. Enable comment visibility...

Buffer overflow

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

MGASA-2019-0214 Updated gvfs packages fix security vulnerabilities

Updated gvfs package fixes security vulnerabilities: daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used CVE-2019-12447. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write CVE-2019-12448...

Cross site scripting

Stored XSS within Quadbase EspressReport ES ERES v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The XSS payload is stored by creating a new user account, and setting the username to an XSS payload. The stored payload c...

Linux lxd mention the right vulnerability analysis using vulnerability warning-the black bar safety net

The core lies in the use of the way, relatively new, not sentence by sentence translation, to ensure that the core point of the presentation is clear, and reproducing the entire Use process. lxc（Linux containers, the Linux that comes with the container; lxd is simply put, the LXD is a Provides RE...

The vulnerability of the user group configuration mechanism in Cisco SD-WAN allows a hacker to elevate their privileges to root level and gain full control over the device.

The vulnerability of the Cisco SD-WAN programmatically-defined user group configuration mechanism is related to access control errors. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level and gain full control over the device by writing a specially...

CVE-2019-1648

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An...

Design/Logic Flaw

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An...

CVE-2019-1648

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An...

CVE-2019-1648 Cisco SD-WAN Solution Privilege Escalation Vulnerability

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An...

CVE-2019-1648 Cisco SD-WAN Solution Privilege Escalation Vulnerability

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An...

CVE-2019-1648

CVE-2019-1648 affects Cisco SD-WAN Solution. A vulnerability in the user group configuration allows an authenticated, local attacker to write a crafted file to the directory containing the group config, bypassing validation and gaining root-level privileges. Impact is full device takeover. Sympto...

Cisco SD-WAN Solution Privilege Escalation Vulnerability

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An...

CVE-2018-13355

CVE-2018-13355 affects TerraMaster TOS 3.1.03; a flawed access control in ajaxdata.php allows attackers to create user groups without proper authorization. This undermines integrity and could enable privilege elevation within the system. No remediation or patch details are provided in the connect...

K-iwi Framework SQL Injection Vulnerability

K-iwi Framework is an open source application development framework developed using PHP. A SQL injection vulnerability exists in K-iwi Framework version 1775. A remote attacker can exploit this vulnerability by sending the 'usergroupid' parameter or the 'userid' parameter to admin/user/group/upda...

CVE-2018-18755

K-iwi Framework 1775 has SQL Injection via the admin/user/group/update usergroupid parameter or the admin/user/user/update userid parameter...

K-iwi Framework 1775 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: K-iwi Framework 1775 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://www.k-iwi.com/ Software Link: https://sourceforge.net/projects/k-iwi/files/latest/download Version: 1775 Category: Webapps Tested on:...

K-iwi Framework 1775 - SQL Injection

Exploit Title: K-iwi Framework 1775 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.k-iwi.com/ Software Link: https://sourceforge.net/projects/k-iwi/files/latest/download Version: 1775 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE:...