Django REST Framework SimpleJWT 5.3.1 Information Disclosure

Exploit Title: djangorestframework-simplejwt 5.3.1 - Information Disclosure Date: 26/01/2024 Exploit Author: Dhrumil Mistry dmdhrumilmistry Vendor Homepage: https://github.com/jazzband/djangorestframework-simplejwt/ Software...

Prime.sol - User can claim Prime token without having any staked XVS, because his stakedAt isn't reset whenever he is issued an irrevocable token.

Lines of code Vulnerability details Impact Whenever a new Prime token is created, the users stakedAt is reset to 0. This happens when the user claim a revocable token and when he is issue a revocable token, but it does not happen when a user is issue an irrevocable token. This is issue function...

Mattermost 注入漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from an inability to limit the parameter values taken from requests during registration, allowing an attacker to register a user as inactive...

CVE-2023-27424

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424 WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424

CVE-2023-27424 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Inactive User Deleter (Korol Yuriy aka Shra) reported for versions up to 1.59. The issue arises from CSRF in unauthenticated contexts; PatchStack notes the fix is in version 1.60. The vulnerability details...

CVE-2023-27424 WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

Inactive User Deleter < 1.60 - Cross-Site Request Forgery

Description Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

WordPress Plugin Inactive User Deleter 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2023-2788 Deactivated user can retain access using oauth2 api

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated...

WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF)

Software Inactive User Deleter Type Plugin Vulnerable versions = 1.59 Fixed in 1.60 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27424 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d63c45f14395 Credits Mika Required...

CVE-2022-36090: Improper Authorization

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service. This means a disabled user can enable themselv...

PYSEC-2018-4

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed method, as demonstrated by discovering whether a user account is inactive...

Users with the same name as an inactive user in a higher priority directory get all that users memberships

h3. Summary In embedded Crowd in at least JIRA and Confluence, when a user is made inactive but retains its groups, then if a lower priority directory has a new user created with the same name, it now inherits their memberships. It seems like the logic used to determine the user authentication by...