CVE Feed

    Dashboard / CVE / CVE-2019-15087

    CVE-2019-15087

    An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execution.

    Published:Sep 20, 2019
    Last Modified:Nov 21, 2024
    EPS:Sep 20, 2019
    EPSS Score:0.03262
    CVSS Score:7.2

    Affected Products

    Vendor
    Prise
    Product
    Adas

    Exploits

    https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adashttps://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas

    Related CVEs

    CVE-2019-15089 (CVSS 8.8) — An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute action…
    CVE-2019-15088 (CVSS 9.8) — An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, u…
    CVE-2019-15086 (CVSS 6.1) — An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a r…
    CVE-2019-15085 (CVSS 7.5) — An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password …
    CVE-2019-14916 (CVSS 6.5) — An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestrict…
    CVE-2019-14915 (CVSS 6.1) — An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when…
    CVE-2019-14914 (CVSS 9.1) — An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, le…
    CVE-2019-14913 (CVSS 5.4) — An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in t…
    CVE-2019-14912 (CVSS 6.1) — An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, le…
    CVE-2019-14911 (CVSS 6.1) — An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, lead…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High