177 matches found
CVE-2024-6624
CVE-2024-6624 affects JSON API User (WordPress) up to v3.9.3, enabling unauthenticated privilege escalation due to improper handling of custom user meta. Exploit activity exists: GitHub exploits show unauthenticated admin registration; Wordfence notes the entry is patched. Affected plugin require...
CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...
CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...
CVE-2024-6676
A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched...
CVE-2024-6676
A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched...
PT-2024-37753 · WordPress · Json Api User +1
Name of the Vulnerable Software and Affected Versions: JSON API User plugin for WordPress versions up to, and including, 3.9.3 Description: The issue is due to improper controls on custom user meta fields, making it possible for unauthenticated attackers to register as administrators on the site...
CVE-2024-6676: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched...
WordPress plugin JSON API User security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2024-6624: Improper Privilege Management
The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...
WordPress JSON API User plugin <= 3.9.3 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Thanh Nam Tran in WordPress Plugin JSON API User versions = 3.9.3...
WordPress JSON API User Plugin <= 3.9.3 is vulnerable to Privilege Escalation
Software JSON API User Type Plugin Vulnerable versions = 3.9.3 Fixed in 3.9.4 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-6624 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID c77720f52f77 Credits Thanh Nam Tran Required privile...
CVE-2024-28270
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...
CVE-2023-6792: Improper Neutralization of Argument Delimiters in a Command
An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...
CVE-2023-36100: Improper Privilege Management
An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser...
CVE-2022-46493: Unrestricted Upload of File with Dangerous Type
Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/downloadimg...
PT-2022-27883
Name of the Vulnerable Software and Affected Versions nbnbk affected versions not specified Description The issue is related to an arbitrary file upload vulnerability. This vulnerability is exploited via the /api/User/download img API endpoint. Recommendations At the moment, there is no informati...
CVE-2022-46493
Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/downloadimg...
CVE-2022-39307
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the "/api/user/password/sent-reset-email" URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leak...
PT-2022-7306
Name of the Vulnerable Software and Affected Versions Grafana versions prior to 8.5.15 Grafana versions 9.0.0 through 9.2.3 Description Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the...