202 matches found
Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...
GHSA-5P54-JJ38-3HXJ Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...
Authorization
TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password...
Cross site request forgery (csrf)
A Cross-Site Request Forgery CSRF in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses...
CVE-2021-42086
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...
Zammad 安全漏洞
Zammad is an open source web-based help desk/customer support system. an elevation of privilege vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit this vulnerability by sending a specially crafted request to modify other agent accounts to be able to log in with...
The vulnerability of the programmatically defined Cisco SD-WAN user management function allows a attacker to modify the account information of any user.
The vulnerability of the programmatically defined user management function in Cisco SD-WAN is related to access control errors. Exploiting this vulnerability could allow a attacker to alter the account information of any arbitrary user...
CVE-2020-6776
A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user Cross-Site Request Forgery...
CVE-2019-11781
Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation...
CVE-2019-11781
Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation...
Unauthorized Access Vulnerability in Yuexun Smart Education Cloud Platform (CNVD-2020-59801)
Yuexun Smart Education Platform is an educational software. Unauthorized access vulnerability exists in Yuexun Intelligent Education Cloud Platform. An attacker can use the vulnerability to overstep the authority to manage all personnel accounts and obtain sensitive information by modifying other...
GE Reason S20 Ethernet Switch Cross-Site Scripting Vulnerability
The GE Reason S20 Ethernet Switch is a General Electric switch from General Electric GE. A cross-site scripting vulnerability exists in the Reason S20 managed Ethernet switches, which stems from a lack of proper validation of client data by a WEB application. An attacker can exploit this...
Logic flaw vulnerability in Extreme CMS (CNVD-2020-38475)
Extreme CMS is an enterprise-level open source content building system. Extreme CMS has a logic flaw vulnerability that can be exploited by attackers to modify account information...
Khan Academy: Unauthorised Account Detail Modification
Introduction ========= Hi 5kyw41k3r here, ==I found an Unauthorised Account Detail Modification in KA website==... Defination ========= It is a flaw which allows a malicious actor to modify the details of an account. I have included a video made by me for demonstration purposes using a test...
U.S. Dept Of Defense: Knowledge Base Articles are Globally Modifiable via ██████
Summary: A user is able to create an account on ██████████ and modify or create any knowledge base articles. This includes articles that have been created by the ██████████ as a canned response to help users with frequently asked questions. Description: Knowledge base articles are used within the...
Automattic: Modify account details by exploiting clickjacking vulnerability on refer.wordpress.com
Summary: I have found that their is no protection for click jacking on refer.wordpress.com so attacker can exploit it to change users details. This clickjacking is on authenticated pages so it is very critical vulnerability. Steps To Reproduce: 1. Create a HTML file with following content...
Symantec Industrial Control System Protection Unauthorized Access Vulnerability
Symantec Industrial Control System Protection ICSP This product provides multidimensional security for industrial control systems and critical infrastructure. A security vulnerability exists in Symantec Industrial Control System Protection ICSP version 6.x.x. An attacker could use this...
CVE-2017-18459
cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...
