CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Hmisoft_vu3_firmware, Hmisoft_vu3, 5p_850, 5p_850_firmware, 9000x, 9000x_firmware, 9000x_programming_and_configuration_software, 9px_ups, 9px_ups_firmware, Eamaxx_series_epdu
2020-01-24
N/A
4.8 MEDIUM
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3.
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.