CVE-2020-35972

An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html...

MediaWiki suffers from an unspecified vulnerability (CNVD-2021-35231)

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.2 and prior versions, which stems from account...

CVE-2021-20998 WAGO: Managed Switches: Unauthorized creation of user accounts

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

Input validation

A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the improper handling of HTTP headers. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A...

PT-2021-2970 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts due to the improper handling of HTTP header...

The vulnerability of the SCADA system of OIK Dispatching Center, related to the storage of confidential information in unencrypted form, allows a intruder to gain access to user account data.

The vulnerability of the SCADA system of OIK Dispatching is related to the storage of confidential information in unencrypted form. Exploiting this vulnerability can allow an intruder to gain access to user account data...

CVE-2021-31552

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account and not...

Code injection

MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message...

CVE-2021-3391

CVE-2021-3391 affects MobileIron Mobile@Work up to 2021-03-22. The vulnerability enables an attacker to distinguish valid, disabled, and nonexistent user accounts by measuring the number of failed login attempts required to trigger a Lockout message, effectively enabling account enumeration. The ...

CVE-2021-3391

MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message...

Garvit Agarwal mifos-mobile 安全漏洞

Garvit Agarwal mifos-mobile is an open source application by Garvit Agarwal. It is used by end-user customers to view/process their account holdings and loans. A security vulnerability exists in mifos-mobile that allows man-in-the-middle attacks...

Turning the page on Solorigate and opening the next chapter for the security community

The recent SolarWinds attack is a moment of reckoning. Today, as we close our own internal investigation of the incident, we continue to see an urgent opportunity for defenders everywhere to unify and protect the world in a more concerted way. We also see an opportunity for every company to adopt...

New Relic: Account Takeover via Email ID Change and Forgot Password Functionality

@dsdh discovered an issue with the email change flow, where emails would be sent to the new email address prior to that address being verified. An attacker could have abused this issue to access vulnerable user accounts...

The vulnerability of the TrueConf Server software, related to deficiencies in the token management mechanism for user accounts, allows a hacker to gain access to the user account.

The vulnerability of the TrueConf Server software is related to deficiencies in the mechanism for managing user tokens. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the TrueConf Server under a user’s identity...

CVE-2020-6776 CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface

A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user Cross-Site Request Forgery...

Privilege Escalation

odoo is vulnerable to privilege escalation. Insecure access controls allows remote authenticated users with access to contact management to modify user accounts, resulting in the attacker obtaining higher privileges...

Egavilanmedia User Registration & Login System Cross-Site Request Forgery Vulnerability

Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A cross-site request forgery vulnerability exists in EgavilanMedia User Registration & Login System with Admin Panel 1.0, which allows to remotely obtain privileges to ...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...