JEA Hybrid Cloud Privilege Escalation

The vulnerability of the JEA Just Enough Administration security technology implemented on the Dell EMC Integrated System for Microsoft Azure Stack Hub hybrid cloud platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to increase their...

httpd daemon Unauthenticated Access Disclosure

The vulnerability of the httpd daemon in the microprogramming-based router software from TP-Link’s TL-WR940N is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to gain unauthorized access to protected information...

CVE-2021-25011

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings...

Security Assessor – Job Description and How to Become

Introduction It requires a ton of work to turn into a QSA and keep your affirmation. In truth, there is an enormous rundown of standards to meet to be thought of. What is a Cyber security control assessor? The Security Control Assessor SCA is a cybersecurity personnel that utilizes security testi...

JetBrains TeamCity Authorization Issues and Vulnerabilities

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. A security vulnerability exists in JetBrains TeamCity, which stems from the product's failure to validate user identities. An unauthenticated attacker could use the vulnerability to...

CVE-2022-24334: Undefined Security Weakness

In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server...

Win-Brute-Logon - Crack Any Microsoft Windows Users Password Without Any Privilege (Guest Account Included)

This PoC was ported in pure PowerShell: https://github.com/DarkCoderSc/power-brute-logon Win Brute Logon Proof Of Concept Release date: 2020-05-14 Target: Windows XP to Latest Windows 10 Version 1909 Weakness location : LogonUserA, LogonUserW, CreateProcessWithLogonA, CreateProcessWithLogonW Usag...

Security Bulletin: IBM PowerVM Novalink is vulnerable to provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to JAX-WS applications.

Summary IBM PowerVM Novalink, which consumes IBM WebSphere Application Server Liberty 21.0.0.10 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to JAX-WS applications. IBM strongly recommends...

Huawei EulerOS: Security Advisory for java-1.7.0-openjdk (EulerOS-SA-2022-1169)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Potential WebSphere Application Server weakness in security affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-1996)

Summary There is a potential for weaker than expected security in WebSphere Application Server which affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details CVEID: CVE-2018-1996 DESCRIPTION: IBM WebSphere Application Server could provide weaker than expecte...

CVE-2022-24553

An issue was found in Zfaka = 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution...

CVE-2021-25075

The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevartduplicatepostparametrssaveindb AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack...

CVE-2022-23848: Undefined Security Weakness

In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability...

CVE-2022-25319: Undefined Security Weakness

An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled...

PT-2022-1959 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: webmin versions prior to 1.990 Description: The issue is related to improper access control in the webmin repository, which can lead to remote code execution. This is due to weaknesses in the authorization mechanism of the File Manager module...

H3C SSL VPN - Username Enumeration

Exploit Title: H3C SSL VPN - Username Enumeration Exploit Author: LiquidWorm H3C SSL VPN Username Enumeration Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd. Product web page: https://www.h3c.com Affected version: n/a Summary: H3C SSL VPN is a secure VPN system based on SSL...

CVE-2022-22854

An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing and editing the user list...

CVE-2021-25050

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

ForgeRock Access Management authorization issue vulnerability

Forgerock ForgeRock Access Management is a comprehensive, unified solution from ForgeRock USA Forgerock designed to quickly enable a superior experience tailored to the unique needs of users and employees. A security vulnerability exists in ForgeRock Access Management 7.1.0, which stems from a la...

WordPress and WordPress plugin access control error vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress CMP plugin version 4.0.19 prior to the authorization problem vulnerability, the vulnerability stems from the...