CVE-2023-43901

EMSigner v2.8.7 is affected by an incorrect access control in the AdHoc User creation form that allows an unauthenticated attacker to arbitrarily modify usernames and privileges by using a registered user’s email address. The issue is tied to the AdHoc User creation flow (root cause: improper acc...

CVE-2023-43901

Incorrect access control in the AdHoc User creation form of EMSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user...

F5 BIG-IP TMUI AJP Smuggling Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/proto/apachejp' class MetasploitModule 'F5 BIG-IP TMUI AJP Smuggling RCE', 'Description' = %q This module exploits a flaw in F5's BIG-IP Traffic Management...

F5 BIG-IP TMUI AJP Smuggling Remote Code Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/proto/apachejp' class MetasploitModule 'F5 BIG-IP TMUI AJP Smuggling RCE', 'Description' = %q This module exploits a flaw in F5's BIG-IP Traffic Management...

CVE-2023-33480

RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

Vulnerability Details fofa： title="BIG-IP" || i...

F5 BIG-IP TMUI AJP Smuggling RCE

This module exploits a flaw in F5's BIG-IP Traffic Management User Interface TMUI that enables an external, unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new account to execute a command payload. Both the exploit and check methods...

Add a new user to the system

This command adds a new user to the system Module Options msf use post/linux/manage/adduser msf postadduser show actions ...actions... msf postadduser set ACTION msf postadduser show options ...show and set options... msf postadduser run This module requires Metasploit:...

PT-2023-22498 · Unknown · Pfsense Ce

Name of the Vulnerable Software and Affected Versions: Pfsense CE version 2.6.0 Description: The issue is related to the absence of a rate limit, which can be exploited by an attacker to create multiple malicious users in the firewall. This can lead to potential security breaches. Recommendations...

CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

CVE-2021-3784

Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created user without an assigned password during some seconds. This...

Authentication flaw

Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created user without an assigned password during some seconds. This...

CVE-2021-3784

Garuda Linux is affected by CVE-2021-3784 due to an insecure user creation/authentication flow: when creating a user via the Garuda Settings Manager, the process may leave the new account without a password for a brief window, enabling an attacker to authenticate as that user locally. The vulnera...

CVE-2023-22618

If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects for example WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B...

PT-2023-12329 · Unknown · Garuda Linux

Name of the Vulnerable Software and Affected Versions: Garuda Linux affected versions not specified Description: The issue is related to an insecure user creation and authentication process in Garuda Linux. When creating users from the 'Garuda settings manager', the system temporarily leaves the...

Garuda Linux License Issues Vulnerability

Garuda Linux is an x86-64 general-purpose Linux distribution from Garuda Linux, based on the Arch Linux operating system. Garuda Linux suffers from a security vulnerability that originates from the execution of an insecure process when creating a user via Garuda Settings Manager, which leaves the...

Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity

TeamCity CVE-2023-42793 Exploit This Python script exploits...

JetBrains TeamCity < 2022.10.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.10.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. CVE-2022-48342 - In JetBrains TeamCity before 2022.10.2 there was an XSS...

CVE-2022-47555 Improper Neutralization of Special Elements in Ormazabal products

Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor...

The vulnerability of the User Creation Handler component of the /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 file in the C-DATA Web Management System allows a malicious individual to escalate their privileges.

The vulnerability of the User Creation Handler component in the /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 system of the C-DATA Web Management System is related to errors in managing access control. Exploiting this vulnerability could allow a malicious actor to increase their privileg...