CVE-2022-1251

The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request...

Employee Leaves Management System Cross-Site Request Forgery Vulnerability

Employee Leaves Management System ELMS is an internal employee management system. A cross-site request forgery vulnerability exists in Employee Leaves Management System ELMS v2.1, which can be exploited by an attacker to change the details of any user profile, such as username, phone number, etc...

Tourism Management System Cross-site Request Forgery Vulnerability

Tourism Management System is a website builder for tourism management. A cross-site request forgery vulnerability exists in Tourism Management System v3.2, which can be exploited by an attacker to change the details of any user profile, such as username, phone number, etc. The vulnerability is...

Improper Access Control in salesagility/suitecrm

Description In SuiteCRM v7.12.4, affecting Users Module, any user with the User Type as Regular User could modify other users profiles via the update profile section. The prerequisite of this attack is by knowing the user record ID and username User Name respectively. The user records ID can be...

CVE-2020-26679

vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profil...

CVE-2020-26680

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to...

Cross site scripting

vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profil...

CVE-2020-26679

CVE-2020-26679 affects vFairs 3.3 and is due to insecure permissions. Any logged-in user can modify other users’ profile information or profile pictures by sending an HTTP POST with another user’s ID, potentially enabling cross-site scripting or uploading PHP webshells as profile images. User IDs...

CVE-2020-26679

vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profil...

vFairs security vulnerabilities

vFairs is a virtual event platform by vFairs Singapore. It can host exciting online conferences, trade shows, job fairs and more. A security vulnerability exists in vFairs version 3.3 that allows any user logged in to vFairs Virtual Meetings to modify other users' profile information or avatars,...

PT-2021-11259

Name of the Vulnerable Software and Affected Versions: vFairs version 3.3 Description: The issue allows any logged-in user to modify other users' profile information or profile picture in a vFairs virtual conference or event. By obtaining a user's unique identification number and their own, an...

Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability (cisco-sa-anyconnect-profile-AggMUCDg)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cisco-sa-anyconnect-profile-AggMUCDg advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

CVE-2021-1519 Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker...

CVE-2020-35737

In Correspondence Management System corms in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference...

PT-2020-17409

Name of the Vulnerable Software and Affected Versions Newgen eGov version 12.0 Description The issue allows an attacker to modify other users' profile information by manipulating the unvalidated UserIndex parameter, which is an example of an Insecure Direct Object Reference. This means that an...

CVE-2020-35737: Undefined Security Weakness

In Correspondence Management System corms in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference...

Tangro Business Workflow Authorization Issues Vulnerability (CNVD-2020-74071)

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A security vulnerability exists in Tangro Business Workflow versions prior to 1.18.1, which can be exploited by an attacker to...

CVE-2020-26175: Authorization Bypass Through User-Controlled Key

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users...

CVE-2020-3435 Cisco AnyConnect Secure Mobility Client for Windows Profile Modification Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on th...

Huawei Mate 20 Access Control Error Vulnerability

Huawei Mate 20 is a smartphone from Chinese company Huawei Huawei. An access control error vulnerability exists in previous versions of Huawei Mate 20 10.0.0.188 C00E74R3P8, which stems from the system's failure to appropriately restrict profile modifications by a specific user, and can be...