CVE-2018-1000875

Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be...

CVE-2012-4501

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs...

CVE-2012-0286

Cross-site request forgery CSRF vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspecified victims for requests that modify user accounts...

CVE-2010-5142

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

CVE-2005-2508

dsidentity in Directory Services in Mac OS X 10.4.2 allows local users to add or remove user accounts...

CVE-2003-0983

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via 1 a "bubba" local user account, 2 an open TCP port 34571, or 3 when a local DHCP server is unavailable, a...

CVE-2025-46744

An authenticated administrator could modify the Created By username for a user account...

CVE-2025-47781 Rallly Insufficient Password Login Token Entropy Leads to Account Takeover

Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the...

Cisco IOS XE Wireless Controller Software Access Control Error Vulnerability

Cisco IOS XE Wireless Controller software is a wireless LAN controller from Cisco. The Cisco IOS XE Wireless Controller Software suffers from an Access Control Error vulnerability that stems from insufficient access control and can be exploited by an attacker to cause the deletion of arbitrary us...

Cloud Foundry UAA 安全漏洞

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry Cloud Platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions 77.21.0 through 7.31.0 that stems from private key exposure in logs...

CVE-2025-46747

An authenticated user without user-management permissions could identify other user accounts...

CVE-2025-46744

An authenticated administrator could modify the Created By username for a user account...

CVE-2025-46745 Improper Privilege Management

An authenticated user without user-management permissions could view other users account information...

CVE-2025-46745

CVE-2025-46745 affects Schweitzer Engineering Laboratories (SEL) software/Blueframe OS family where an authenticated user with lower privileges can view other users’ account information due to an improper privilege management/root-cause issue. Reported impact is information disclosure (confidenti...

CVE-2025-46744 Improper Privilege Management

An authenticated administrator could modify the Created By username for a user account...

CVE-2025-46744

CVE-2025-46744 describes an authenticated administrator privilege‑escalation flaw: the attacker can modify the Created By username on a user account. Public references tie this to Schweitzer Engineering Laboratories (SEL) products (e.g., SEL‑5033 acSELerator RTAC software and related tools) and m...

CVE-2025-46744 Improper Privilege Management

An authenticated administrator could modify the Created By username for a user account...

PT-2025-20728 · Flytxt · Flytxt Neon-Dx

Name of the Vulnerable Software and Affected Versions: Flytxt NEON-dX version 0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c Description: The issue concerns the userId parameter in the change password function, allowing attackers to execute brute force attacks to discover user passwords. This could potential...

PT-2025-20716 · Schweitzer Engineering Laboratories · Sel Blueframe Os

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An authenticated administrator could modify the Created By username for a user account. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

CVE-2025-3924

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The plugin looks up the 'validemail' value based solely on a supplied username parameter, without verifying that the requester is associated...