Woocommerce Customers Manager < 26.5 - Arbitrary Account Creation/Update by Low Privilege Users

The uploadcsv AJAX action, available to authenticated users, did not have proper capability checks. allowing any authenticated users, such as a subscriber, to call it and import arbitrary users. They could either update their own account, to make themselves administrator, or create new...

UBUNTU-CVE-2020-27781

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Sumavision Enhanced Multimedia Router Cross-Site Request Forgery Vulnerability

The Sumavision Enhanced Multimedia Router EMR is an Enhanced Multimedia Router from China Digital Vision Technology Sumavision. The Sumavision Enhanced Multimedia Router suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to create arbitrary users...

Cross site request forgery (csrf)

goform/formEMR30 in Sumavision Enhanced Multimedia Router EMR 3.0.4.27 allows creation of arbitrary users with elevated privileges administrator on a device, as demonstrated by a setString=newuseradministrator123456 request...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

Authentication Bypass

opencast-kernel is vulnerable to authentication bypass. The vulnerability exists as a fake remember-me token can be used to gain access of arbitrary users without the need to be authenticated...

CVE-2014-9013

The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmpppajaxcall with an execution target of wpinsertuser...

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...

Cisco Unity Connection Cross-Site Request Forgery Vulnerability

Cross-site request forgery CSRF vulnerability in Cisco Unity Connection 11.50.98 allows remote attackers to hijack the authentication of arbitrary users. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid130013; scriptversion"1.3"; scriptcvsdate"Date: 2019/10/31...

CVE-2019-4066

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...

Design/Logic Flaw

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...

CVE-2019-4066

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...

CVE-2018-7701

Multiple cross-site request forgery CSRF vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 delete e-mail messages via a delete action in a request to secmail/getmessage.exe or 2 spoof arbitrary users a...

CVE-2012-0699

Multiple cross-site request forgery CSRF vulnerabilities in Family Connections CMS aka FCMS 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that 1 add news via an add action to familynews.php or 2 add a prayer via an add action to prayers.php...

CVE-2014-0120

Cross-site request forgery CSRF vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."...

CVE-2014-0120

Cross-site request forgery CSRF vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."...

VIEWGOOD's All Media Resource Distribution Platform Has Logic Design Flaws

WebCDN is a cloud-based service platform that integrates application and resource provisioning. A logical design vulnerability exists in WebCDN, which can be exploited by an attacker to reset arbitrary user passwords...