EUVD-2020-4050

Malware in sbrugna...

Authorization Bypass

github.com/flipped-aurora/gin-vue-admin is vulnerable to authorization bypass. The vulnerability exists in setuserinfo function of sysuser.go because the user roles are not properly authorized which allows a malicious user to modify any information of the administrator...

CVE-2022-21660

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the "setUserInfo" function. Users are advised to update as soon as possible. There are no known workarounds...

CVE-2022-21660 Missing authorization in gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...

Gin-Vue-Admin 权限许可和访问控制问题漏洞

Gin-Vue-Admin is a full-stack pre-development infrastructure platform based on Vue and Gin development. A permission permission and access control issue vulnerability exists in gin-vue-admin, which stems from a lack of authentication in the setUserInfo function, which allows a low-privileged user...

PT-2022-15015

Name of the Vulnerable Software and Affected Versions Gin-vue-admin versions prior to 2.4.7 Description The issue affects Gin-vue-admin, a backstage management system based on vue and gin, where low privilege users can modify higher privilege users due to missing authentication on the setUserInfo...

CVE-2022-21660: Missing Authorization

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...

CVE-2020-11708

An issue was discovered in ProVide formerly zFTPServer through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of the EXECUTE feature, which is for executing programs when certain events are triggered...

CVE-2020-11704

An issue was discovered in ProVide formerly zFTPServer through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is Reflected via the groups parameter. GetUserInfo is Reflected via POST data. SetUserInfo is Stored via the general parameter...

Privilege escalation

An issue was discovered in ProVide formerly zFTPServer through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of the EXECUTE feature, which is for executing programs when certain events are triggered...

CVE-2020-11708

An issue was discovered in ProVide formerly zFTPServer through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of the EXECUTE feature, which is for executing programs when certain events are triggered...

PT-2020-12795

Name of the Vulnerable Software and Affected Versions ProVide formerly zFTPServer versions through 13.1 Description An issue in the software allows for privilege escalation via the "/ajax/SetUserInfo" API endpoint, specifically through the messages parameter. This is due to the EXECUTE feature,...

CVE-2020-11704: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ProVide formerly zFTPServer through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is Reflected via the groups parameter. GetUserInfo is Reflected via POST data. SetUserInfo is Stored via the general parameter...

PT-2020-12791

Name of the Vulnerable Software and Affected Versions ProVide formerly zFTPServer versions through 13.1 Description The issue concerns Multiple Stored and Reflected XSS in the Admin Web Interface. Specifically, GetInheritedProperties is reflected via the groups parameter, GetUserInfo is reflected...

CVE-2020-11708: Improper Privilege Management

An issue was discovered in ProVide formerly zFTPServer through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of the EXECUTE feature, which is for executing programs when certain events are triggered...