| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-4220 | Med | 0.36 | 5.5 | 0.00 | Jun 6, 2019 | IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229. | ||
| CVE-2019-4201 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2019 | IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL… | ||
| CVE-2019-4185 | Hig | 0.54 | 8.3 | 0.01 | Jun 6, 2019 | IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-Force ID: 158975. | ||
| CVE-2019-4056 | Med | 0.28 | 4.3 | 0.01 | Jun 6, 2019 | IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565. | ||
| CVE-2019-4048 | Low | 0.14 | 2.1 | 0.00 | Jun 6, 2019 | IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311. | ||
| CVE-2018-2028 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2019 | IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID: 155554. | ||
| CVE-2018-10171 | Cri | 0.64 | 9.8 | 0.02 | Jun 5, 2019 | Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper` component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to… | ||
| CVE-2019-9158 | Med | 0.37 | 5.7 | 0.01 | Jun 5, 2019 | Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control. | ||
| CVE-2019-9157 | Med | 0.37 | 5.7 | 0.01 | Jun 5, 2019 | Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure. | ||
| CVE-2019-9156 | Hig | 0.52 | 8.0 | 0.03 | Jun 5, 2019 | Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection. | ||
| CVE-2019-8385 | Cri | 0.68 | 9.8 | 0.20 | Jun 5, 2019 | An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive… | ||
| CVE-2019-7672 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2019 | Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges. | ||
| CVE-2019-7671 | Cri | 0.62 | 9.0 | 0.08 | Jun 5, 2019 | Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site. | ||
| CVE-2019-6800 | Hig | 0.49 | 7.5 | 0.01 | Jun 5, 2019 | In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject… | ||
| CVE-2019-12494 | Hig | 0.55 | 8.5 | 0.02 | Jun 5, 2019 | In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked. | ||
| CVE-2019-9189 | Hig | 0.61 | 8.8 | 0.11 | Jun 5, 2019 | Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an… | ||
| CVE-2019-9187 | Hig | 0.49 | 7.5 | 0.02 | Jun 5, 2019 | ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs. | ||
| CVE-2019-5394 | Med | 0.33 | 5.1 | 0.00 | Jun 5, 2019 | The HPE Nonstop Maintenance Entity family of products are vulnerable to local disclosure of information, such as system layout and configuration. | ||
| CVE-2019-12276 | Hig | 0.56 | 7.5 | 0.60 | Jun 5, 2019 | A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for… | ||
| CVE-2019-12196 | Cri | 0.69 | 9.8 | 0.69 | Jun 5, 2019 | A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter. | ||
| CVE-2019-11988 | Cri | 0.64 | 9.8 | 0.01 | Jun 5, 2019 | A Remote Unauthorized Access vulnerability was identified in HPE Smart Update Manager (SUM) earlier than version 8.3.5. | ||
| CVE-2019-11987 | Hig | 0.51 | 7.8 | 0.00 | Jun 5, 2019 | A security vulnerability in HPE Smart Update Manager (SUM) prior to v8.4 could allow local unauthorized elevation of privilege. | ||
| CVE-2019-11226 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2019 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. | ||
| CVE-2019-9642 | Cri | 0.64 | 9.8 | 0.02 | Jun 5, 2019 | An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution… | ||
| CVE-2019-9548 | Cri | 0.65 | 10.0 | 0.01 | Jun 5, 2019 | Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control. | ||
| CVE-2019-1882 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2019 | A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit… | ||
| CVE-2019-1881 | Med | 0.31 | 4.7 | 0.01 | Jun 5, 2019 | A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to… | ||
| CVE-2019-1880 | Med | 0.29 | 4.4 | 0.00 | Jun 5, 2019 | A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware… | ||
| CVE-2019-1872 | Med | 0.35 | 5.3 | 0.02 | Jun 5, 2019 | A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on… | ||
| CVE-2019-1870 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2019 | A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The… | ||
| CVE-2019-1868 | Hig | 0.49 | 7.5 | 0.02 | Jun 5, 2019 | A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based management interface. An… | ||
| CVE-2019-1861 | Hig | 0.47 | 7.2 | 0.04 | Jun 5, 2019 | A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit… | ||
| CVE-2019-1845 | Hig | 0.56 | 8.6 | 0.05 | Jun 5, 2019 | A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a… | ||
| CVE-2019-1842 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2019 | A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when… | ||
| CVE-2019-12555 | Hig | 0.49 | 7.5 | 0.01 | Jun 5, 2019 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application. | ||
| CVE-2019-12554 | Hig | 0.49 | 7.5 | 0.01 | Jun 5, 2019 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application. | ||
| CVE-2019-12553 | Cri | 0.64 | 9.8 | 0.02 | Jun 5, 2019 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution. | ||
| CVE-2019-11983 | Hig | 0.46 | 7.0 | 0.01 | Jun 5, 2019 | A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39. | ||
| CVE-2019-11982 | Hig | 0.54 | 8.3 | 0.02 | Jun 5, 2019 | A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39. | ||
| CVE-2019-9730 | Hig | 0.57 | 8.8 | 0.01 | Jun 5, 2019 | Incorrect access control in the CxUtilSvc component of the Synaptics Sound Device drivers prior to version 2.29 allows a local attacker to increase access privileges to the Windows Registry via an unpublished API. | ||
| CVE-2019-9673 | Hig | 0.58 | 8.8 | 0.04 | Jun 5, 2019 | Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI. | ||
| CVE-2019-9647 | Med | 0.43 | 6.1 | 0.02 | Jun 5, 2019 | Gila CMS 1.9.1 has XSS. | ||
| CVE-2019-12742 | Hig | 0.57 | 8.8 | 0.01 | Jun 5, 2019 | Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter). | ||
| CVE-2019-11986 | Hig | 0.57 | 8.8 | 0.04 | Jun 5, 2019 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||
| CVE-2019-11985 | Hig | 0.57 | 8.8 | 0.04 | Jun 5, 2019 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||
| CVE-2019-11984 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2019 | A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||
| CVE-2019-11980 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2019 | A remote code exection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||
| CVE-2019-11979 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2019 | A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||
| CVE-2019-11978 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2019 | A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||
| CVE-2019-11977 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2019 | A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
- risk 0.36cvss 5.5epss 0.00
IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229.
- risk 0.40cvss 6.1epss 0.01
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL…
- risk 0.54cvss 8.3epss 0.01
IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-Force ID: 158975.
- risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565.
- risk 0.14cvss 2.1epss 0.00
IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311.
- risk 0.42cvss 6.5epss 0.01
IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID: 155554.
- risk 0.64cvss 9.8epss 0.02
Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper` component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to…
- risk 0.37cvss 5.7epss 0.01
Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.
- risk 0.37cvss 5.7epss 0.01
Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.
- risk 0.52cvss 8.0epss 0.03
Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.
- risk 0.68cvss 9.8epss 0.20
An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive…
- risk 0.57cvss 8.8epss 0.02
Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges.
- risk 0.62cvss 9.0epss 0.08
Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site.
- risk 0.49cvss 7.5epss 0.01
In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject…
- risk 0.55cvss 8.5epss 0.02
In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.
- risk 0.61cvss 8.8epss 0.11
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an…
- risk 0.49cvss 7.5epss 0.02
ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
- risk 0.33cvss 5.1epss 0.00
The HPE Nonstop Maintenance Entity family of products are vulnerable to local disclosure of information, such as system layout and configuration.
- risk 0.56cvss 7.5epss 0.60
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for…
- risk 0.69cvss 9.8epss 0.69
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
- risk 0.64cvss 9.8epss 0.01
A Remote Unauthorized Access vulnerability was identified in HPE Smart Update Manager (SUM) earlier than version 8.3.5.
- risk 0.51cvss 7.8epss 0.00
A security vulnerability in HPE Smart Update Manager (SUM) prior to v8.4 could allow local unauthorized elevation of privilege.
- risk 0.35cvss 5.4epss 0.01
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution…
- risk 0.65cvss 10.0epss 0.01
Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control.
- risk 0.35cvss 5.4epss 0.01
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit…
- risk 0.31cvss 4.7epss 0.01
A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to…
- risk 0.29cvss 4.4epss 0.00
A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware…
- risk 0.35cvss 5.3epss 0.02
A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based management interface. An…
- risk 0.47cvss 7.2epss 0.04
A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit…
- risk 0.56cvss 8.6epss 0.05
A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when…
- risk 0.49cvss 7.5epss 0.01
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
- risk 0.49cvss 7.5epss 0.01
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
- risk 0.64cvss 9.8epss 0.02
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
- risk 0.46cvss 7.0epss 0.01
A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.
- risk 0.54cvss 8.3epss 0.02
A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.
- risk 0.57cvss 8.8epss 0.01
Incorrect access control in the CxUtilSvc component of the Synaptics Sound Device drivers prior to version 2.29 allows a local attacker to increase access privileges to the Windows Registry via an unpublished API.
- risk 0.58cvss 8.8epss 0.04
Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI.
- risk 0.43cvss 6.1epss 0.02
Gila CMS 1.9.1 has XSS.
- risk 0.57cvss 8.8epss 0.01
Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).
- risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- risk 0.57cvss 8.8epss 0.02
A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- risk 0.57cvss 8.8epss 0.02
A remote code exection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- risk 0.57cvss 8.8epss 0.02
A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- risk 0.57cvss 8.8epss 0.02
A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
- risk 0.57cvss 8.8epss 0.02
A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.