CVE-2022-36954

In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10...

CVE-2022-36954: Undefined Security Weakness

In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10...

Veritas NetBackup 安全漏洞

Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports ransomware detection and backup protection of environmental data such as metadata and virtual environments. A security vulnerabilit...

GHSA-5P54-JJ38-3HXJ Apache Archiva does not require entry of the administrator's password at the time of modifying a user account

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...

Apache Archiva does not require entry of the administrator's password at the time of modifying a user account

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...

Authorization

TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses...

CVE-2021-42086

An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...

Zammad 安全漏洞

Zammad is an open source web-based help desk/customer support system. an elevation of privilege vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit this vulnerability by sending a specially crafted request to modify other agent accounts to be able to log in with...

The vulnerability of the programmatically defined Cisco SD-WAN user management function allows a attacker to modify the account information of any user.

The vulnerability of the programmatically defined user management function in Cisco SD-WAN is related to access control errors. Exploiting this vulnerability could allow a attacker to alter the account information of any arbitrary user...

CVE-2020-6776

A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user Cross-Site Request Forgery...

CVE-2019-11781

Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation...

CVE-2019-11781

Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation...

Unauthorized Access Vulnerability in Yuexun Smart Education Cloud Platform (CNVD-2020-59801)

Yuexun Smart Education Platform is an educational software. Unauthorized access vulnerability exists in Yuexun Intelligent Education Cloud Platform. An attacker can use the vulnerability to overstep the authority to manage all personnel accounts and obtain sensitive information by modifying other...

GE Reason S20 Ethernet Switch Cross-Site Scripting Vulnerability

The GE Reason S20 Ethernet Switch is a General Electric switch from General Electric GE. A cross-site scripting vulnerability exists in the Reason S20 managed Ethernet switches, which stems from a lack of proper validation of client data by a WEB application. An attacker can exploit this...

Logic flaw vulnerability in Extreme CMS (CNVD-2020-38475)

Extreme CMS is an enterprise-level open source content building system. Extreme CMS has a logic flaw vulnerability that can be exploited by attackers to modify account information...

Khan Academy: Unauthorised Account Detail Modification

Introduction ========= Hi 5kyw41k3r here, ==I found an Unauthorised Account Detail Modification in KA website==... Defination ========= It is a flaw which allows a malicious actor to modify the details of an account. I have included a video made by me for demonstration purposes using a test...

U.S. Dept Of Defense: Knowledge Base Articles are Globally Modifiable via ██████

Summary: A user is able to create an account on ██████████ and modify or create any knowledge base articles. This includes articles that have been created by the ██████████ as a canned response to help users with frequently asked questions. Description: Knowledge base articles are used within the...

CVE-2019-16029: Improper Input Validation

A vulnerability in the application programming interface API of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service DoS condition of the web interface. The...

Automattic: Modify account details by exploiting clickjacking vulnerability on refer.wordpress.com

Summary: I have found that their is no protection for click jacking on refer.wordpress.com so attacker can exploit it to change users details. This clickjacking is on authenticated pages so it is very critical vulnerability. Steps To Reproduce: 1. Create a HTML file with following content...