CVE-2019-15128

CVE-2019-15128 affects iF.SVNAdmin through v1.6.2. The root cause is a CSRF in svnadmin/usercreate.php that allows an attacker to create a user. Impact stated: ability to create a user via cross-site request forgery; no further exploitation details provided in the sources. No remediation details ...

CVE-2019-15128

iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user...

YouPHPTube SQL Injection Vulnerability (CNVD-2019-41830)

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in the userCreate.json.php file in YouPHPTube version 7.2. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications, which can be exploited by attacker...

Group admins can create users with IDs of system folders (NC-SA-2019-015)

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...

Unspecified vulnerability in cPanel (CNVD-2019-26331)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. cPanel has a security vulnerability in versions prior to cPanel 66.0.2. An attacker can exploit the vulnerability to...

CVE-2017-18421

cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...

MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link:...

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution Date: 2019-07-12 Exploit Author: Chris Lyne @lynerc Vendor Homepage: https://www.citrix.com Product: Citrix SD-WAN Software Link:...

CVE-2018-12628

An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges...

CVE-2019-4066

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...

CVE-2019-4066

IBM IOC CVE-2019-4066 affects IBM Intelligent Operations Center (IOC) 5.1.0–5.2.0; IOC for Emergency Management 5.1.0–5.1.0.6; and Water Operations for Waternamics 5.1.0–5.2.1.1. An authenticated user can create arbitrary user accounts, causing ID-management issues and potentially enabling code e...

IBM Water Operations for Waternamics and IBM Intelligent Operations Center Input Validation Error Vulnerability

IBM Intelligent Operations Center IOC and IBM Water Operations for Waternamics are both products of IBM Corporation, U.S.A. IBM Intelligent Operations Center is a suite of city operations solutions. IBM Intelligent Operations Center is a suite of city operations solutions with features such as da...

Security Bulletin: IBM® Intelligent Operations Center has a weak user-creation policy (CVE-2019-4066)

Summary An authenticated user can create users with malformed user IDs in IBM® Intelligent Operations Center so that these new users cannot be deleted later from the system. Because the malformed users cannot be deleted at the application level, this is a denial of service issue. Vulnerability...

SoftNAS Cloud Command Execution Vulnerability

SoftNAS Cloud is a software-defined NAS file management system from US-based SoftNAS. The system is primarily used to provide enterprise-class NAS functionality, including encryption, snapshots and automatic failover. A security vulnerability exists in SoftNAS Cloud versions 4.2.0 and 4.2.1. A...

Cross-Site Scripting (XSS)

nexus-core is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the repoId and format parameters of the healthCheckFileDetail function, the file name in the File Upload functionality of Staging Upload, the username when...

njiandan-cms cross-site request forgery vulnerability

njiandan-cms is a PHP-based content management system CMS. A cross-site request forgery vulnerability exists in njiandan-cms version 2013-05-23 and earlier. A remote attacker can exploit this vulnerability to add an administrator account with the help of the index.php/admin/usernew URL...

LayerBB 1.1.2 Cross Site Request Forgery

Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description: LayerBB is a free open-source forum software, the CSRF...

snapd 2.37 (Ubuntu) dirty_sock Local Privilege Escalation

!/usr/bin/env python3 """ dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available...

Exploit for Incorrect Authorization in Canonical Snapd

dirtysock: Linux Privilege Escalation via snapd In January...

Ubuntu snapd < 2.37.1 - Local Privilege Escalation

dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and educatio...