36 matches found
CVE-2024-50358
A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by authenticated users by restoring a tampered...
GO-2022-1019 lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs...
CVE-2021-44667
A Cross Site Scripting XSS vulnerability exists in Nacos 2.0.3 in auth/users via the 1 pageSize and 2 pageNo parameters...
Cross-site Scripting (XSS) - Stored in admidio/admidio
Description When adding a menu after logging in with an administrator account, there is no verification of the URL value, so the XSS payload is stored in the DB. After that, when you click the saved menu, XSS is triggered. If an administrator adds a menu, normal users can click it too. Proof of...
CVE-2019-7566
CSZ CMS 1.1.8 has CSRF via admin/users/new/add...
CVE-2018-15569
my little forum 2.4.12 allows CSRF for deletion of users...
CVE-2018-9047
In Windows Master aka Windows Optimization Master 7.99.13.604, the driver file WoptiHWDetect.SYS allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002841...
Debian Security Advisory DSA 2917-1 (super - security update)
John Lightsey of the Debian Security Audit project discovered that the super package did not check for setuid failures, allowing local users to increase the privileges on kernel versions which do not guard against RLIMITNPROC attacks. OpenVAS Vulnerability Test $Id: deb2917.nasl 6715 2017-07-13...
CVE-2013-0200
HP Linux Imaging and Printing HPLIP through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the 1 /tmp/hpcupsfilterc.bmp, 2 /tmp/hpcupsfilterk.bmp, 3 /tmp/hpcupsjob.out, 4 /tmp/hpijs.out, or 5 /tmp/hppsjob.out temporary file, a different vulnerability than...
CVE-2011-0762
The vsffilenamepassesfilter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service CPU consumption and process slot exhaustion via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632...
CVE-2010-3834
CVE-2010-3834 affects MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6. The vulnerability arises from two related vectors: (1) materializing a derived table that required a temporary table for grouping, and (2) issues with user variable assignments. Successful exploitation could a...
CVE-2010-0716
layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files aka attachments, which allows remote authenticated users to leverage same-origin relationships and...
kernel: linux x86_64 ia32 emulation leaks uninitialized data
Unspecified vulnerability in the 32-bit and 64-bit emulation in the Linux kernel 2.6.9, 2.6.18, and probably other versions allows local users to read uninitialized memory via unknown vectors involving a crafted binary...
CVE-2004-2258
Xconfig in Hummingbird Exceed before 9.0.0.1, when the Screen Definition is password-protected, allows local users to access certain options by switching to another tab, then switching back to the original tab...