2131 matches found
CVE-2022-32310
CVE-2022-32310 affects Ingredient Stock Management System v1.0. The issue is an access-control flaw in the Users.php endpoint that lets an unauthenticated attacker obtain or take over user accounts via a crafted POST request. Impact per sources indicates account takeover with no required user int...
SAP NetWeaver AS ABAP Information Disclosure (2963137)
A user enumeration vulnerability may be present in SAP NetWeaver Application Server ABAP. This could be exploited to gain a list of user accounts and personal user information via the POWL test application, leading to information disclosure. Note that Nessus has not tested for this issue but has...
CVE-2022-31294
An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...
CVE-2022-31294
An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...
CVE-2022-31294
An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...
Design/Logic Flaw
An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...
CVE-2022-31294
The CVE-2022-31294 issue affects Online Discussion Forum Site 1.0 (Sourcecodester). A flaw in the save_users() function allows unauthenticated attackers to arbitrarily create or update user accounts, enabling potential account takeover. Documents confirm the vulnerability path and mention an expl...
CVE-2022-31294
An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...
Generation of Error Message Containing Sensitive Information
Description The software generates an error message that includes sensitive information about its environment, users, or associated data. Proof of Concept When logging in, the login page will tell you whether or not a username exists which is a vulnerability since it can be paired with the lack o...
Login timing attack in ibexa/core
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...
GHSA-2X4V-G8CX-JXRQ Login timing attack in ibexa/core
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...
Login timing attack in ezsystems/ezpublish-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...
GHSA-342C-VCFF-2FF2 Login timing attack in ezsystems/ezplatform-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...
The vulnerability of the SCADA system “SKADA-NEV” is related to weak password requirements, allowing attackers to gain access to the user account.
The vulnerability of the SCADA system “SKADA-NEV” is related to weak password requirements. Exploiting this vulnerability can allow a malicious actor to gain access to the user account by force...
GHSA-P9XF-3RM3-QH2H Wildfly-Core user account mismanagement
A flaw was found in Wildfly. An incorrect JBOSSLOCALUSER challenge location when using the elytron configuration may lead to JBOSSLOCALUSER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects...
Open Automation Software OAS Platform REST API unauthenticated vulnerability
Summary An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...
Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet
In LifeRay Portal CE 7.1.0 through 7.2.1, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will...
GHSA-GQQF-8CX6-9R7H Umbraco CMS vulnerable to CSRF
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...
GHSA-FGJ8-93XX-F6G6 phpMyAdmin SQL injection in user accounts page
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server...
phpMyAdmin SQL injection in user accounts page
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server...