CVE-2020-26680

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to...

Cross site scripting

vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profil...

CVE-2020-26679

CVE-2020-26679 affects vFairs 3.3 and is due to insecure permissions. Any logged-in user can modify other users’ profile information or profile pictures by sending an HTTP POST with another user’s ID, potentially enabling cross-site scripting or uploading PHP webshells as profile images. User IDs...

CVE-2020-26679

vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profil...

vFairs 安全漏洞

vFairs is a virtual event platform by vFairs Singapore. It can host exciting online conferences, trade shows, job fairs and more. A security vulnerability exists in vFairs version 3.3 that allows any user logged in to vFairs Virtual Meetings to modify other users' profile information or avatars,...

PT-2021-11259

Name of the Vulnerable Software and Affected Versions: vFairs version 3.3 Description: The issue allows any logged-in user to modify other users' profile information or profile picture in a vFairs virtual conference or event. By obtaining a user's unique identification number and their own, an...

Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability (cisco-sa-anyconnect-profile-AggMUCDg)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cisco-sa-anyconnect-profile-AggMUCDg advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

CVE-2021-1519 Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker...

CVE-2020-35737

In Correspondence Management System corms in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference...

CVE-2020-35737: Undefined Security Weakness

In Correspondence Management System corms in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference...

PT-2020-17409

Name of the Vulnerable Software and Affected Versions Newgen eGov version 12.0 Description The issue allows an attacker to modify other users' profile information by manipulating the unvalidated UserIndex parameter, which is an example of an Insecure Direct Object Reference. This means that an...

Tangro Business Workflow Authorization Issues Vulnerability (CNVD-2020-74071)

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A security vulnerability exists in Tangro Business Workflow versions prior to 1.18.1, which can be exploited by an attacker to...

CVE-2020-26175: Authorization Bypass Through User-Controlled Key

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users...

CVE-2020-3435 Cisco AnyConnect Secure Mobility Client for Windows Profile Modification Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on th...

Huawei Mate 20 Access Control Error Vulnerability

Huawei Mate 20 is a smartphone from Chinese company Huawei Huawei. An access control error vulnerability exists in previous versions of Huawei Mate 20 10.0.0.188 C00E74R3P8, which stems from the system's failure to appropriately restrict profile modifications by a specific user, and can be...

Unspecified Vulnerability in WordPress Ultimate Member

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. An unspecified vulnerability exists in...

CVE-2020-6859

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

PT-2020-19271

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.1.3 Description The issue allows remote attackers to change other users' profiles and cover photos via a modified user id parameter. This is related to ajax image upload and ajax resize image function...

CVE-2019-10271

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...

CVE-2019-10271: Undefined Security Weakness

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...