Qualys Cloud Platform 8.21.6 New Features

Update Nov 19, 2019: This blog post was updated with additional detail about the new features in 8.21.6. The 8.21.6 release adds several new features in Qualys Cloud Platform, Policy Compliance, and Vulnerability Management. Apart from various other new features, this release adds support for App...

CVE-2019-12147

The Sangoma Session Border Controller SBC 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to th...

Sangoma SBC 2.3.23-119-GA Authentication Bypass Vulnerability

A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to bypass authentication and login as a non-existent user but with complete access to the dashboard including additional privileged user creation capabilities...

Sangoma Technologies SBC Parameter Injection Vulnerability

The Sangoma Technologies SBC is a border session controller SBC from Sangoma Technologies, a Canadian company. A parameter injection vulnerability exists in Sangoma Technologies SBC version 2.3.23-119-GA, which can be exploited by an attacker to bypass authentication and log in as a non-existing...

Sangoma SBC 2.3.23-119-GA Unauthenticated User Creation

Introduction Description A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to create a privileged user on the system using the web application login interface. Vulnerability Type - Argument Injection or Modification...

Fedora 30 : phpMyAdmin (2019-6404181bf9)

Upstream announcement : Welcome to phpMyAdmin 4.9.1, a bugfix release. This is a regularly-schedule bugfix release that also includes some security hardening measures. We wish to point out that this also includes a routine fix for an issue that has been reported as CVE-2019-12922. The fix for thi...

DRUPAL-CONTRIB-2019-066

This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's setting for "Who can register accounts?" when set to "Visitors, but administrator approval is required". When this option is chosen, the module overrides the setting, and makes it...

CVE-2019-15128

iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user...

CVE-2019-15128

iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user...

CVE-2019-15128

iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user...

CVE-2019-15128

CVE-2019-15128 affects iF.SVNAdmin through v1.6.2. The root cause is a CSRF in svnadmin/usercreate.php that allows an attacker to create a user. Impact stated: ability to create a user via cross-site request forgery; no further exploitation details provided in the sources. No remediation details ...

YouPHPTube SQL Injection Vulnerability (CNVD-2019-41830)

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in the userCreate.json.php file in YouPHPTube version 7.2. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications, which can be exploited by attacker...

Group admins can create users with IDs of system folders (NC-SA-2019-015)

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...

Unspecified vulnerability in cPanel (CNVD-2019-26331)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. cPanel has a security vulnerability in versions prior to cPanel 66.0.2. An attacker can exploit the vulnerability to...

CVE-2017-18421

cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution Date: 2019-07-12 Exploit Author: Chris Lyne @lynerc Vendor Homepage: https://www.citrix.com Product: Citrix SD-WAN Software Link:...

MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link:...

CVE-2018-12628

An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges...

CVE-2019-4066

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...

CVE-2019-4066

IBM IOC CVE-2019-4066 affects IBM Intelligent Operations Center (IOC) 5.1.0–5.2.0; IOC for Emergency Management 5.1.0–5.1.0.6; and Water Operations for Waternamics 5.1.0–5.2.1.1. An authenticated user can create arbitrary user accounts, causing ID-management issues and potentially enabling code e...