9092 matches found
OPMS Cross-site Request Forgery Vulnerability
OPMS is an OA management system. v1.3 and previous versions of OPMS contain a security vulnerability that can be exploited to add arbitrary user accounts via /user/add...
Rockoa 跨站请求伪造漏洞
RockOA Letter Call is an open source office OA system. v1.9.8 of Rockoa has a security vulnerability that can be exploited by attackers to arbitrarily add administrator accounts...
OPMS 跨站请求伪造漏洞
OPMS is an OA management system. v1.3 and previous versions of OPMS contain a security vulnerability that can be exploited to add arbitrary user accounts via /user/add...
Time to Ditch Big-Brother Accounts for Network Scanning
In almost every network, there is a highly privileged service account remotely connecting to all computers. These accounts are usually used by backup, security or monitoring solutions. But using such accounts to remotely login to systems on the network introduces unnecessary risk — it’s a bad...
CVE-2021-35248
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings...
Input validation
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings...
CVE-2021-35248 Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings...
Keycloak: Incorrect authorization allows unpriviledged users to create other users
A flaw was found in Keycloak version from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled...
Keycloak: Incorrect authorization allows unpriviledged users to create other users
A flaw was found in Keycloak version from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled...
The software for email security, SonicWall Email Security and SonicWall Hosted Email Security, has vulnerabilities related to insecure privilege management. This allows attackers to create accounts with administrator privileges.
The vulnerability of SonicWall Email Security and SonicWall Hosted Email Security software-related to insecure privilege management. Exploiting this vulnerability can allow a malicious actor to create an administrator-account using a specially crafted HTTP request...
Facebook Bans Spy-for-Hire Firms for Targeting 50K People
Meta, Facebook’s parent company, has kicked six alleged spy-for-hire “cyber-mercenaries” to the curb, along with a mysterious Chinese law-enforcement supplier. It accused the entities of collectively targeting about 50,000 people for surveillance. In a report PDF entitled “Threat Report on the...
CVE-2021-4133
A flaw was found in Keycloak version from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled. Mitigation Access to the user-creation functionality in the...
CVE-2021-41962
creationtimestamp| type| source ---|---|--- 2021-12-16 20:36:15+00:00| seen| https://t.me/cibsecurity/34152 2021-12-17 07:40:04+00:00| seen| https://t.me/BlueRedTeam/1512 2023-11-22 10:27:55+00:00| published-proof-of-concept| Telegram/vHTtKQxmAT3f8pPJYMyZLW3MJn6GFVTdkZIulMbNHlsBg 2024-10-21...
CVE-2021-43833
eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address. This vulnerability impacts all instances that have not set a...
Elabftw 授权问题漏洞
Elabftw is an open source platform for hosting experimental data. The platform runs on Linux and supports storing a wide range of objects. An authorization issue vulnerability exists in eLabFTW that allows any authenticated user to access arbitrary accounts by setting a specially designed email...
User Management System 跨站请求伪造漏洞
User Management System is a Php user management system using stored procedures by Anuj Kumar, an individual developer. A security vulnerability exists in user management system that allows an attacker to change passwords to arbitrary accounts...
Code injection
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldapid attribute of a user during the daily synchronization. A malicious user could force accounts to ...
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...
CVE-2021-44524
A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...
CVE-2021-44524
A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...