Improper Authorization

org.keycloak:keycloak-quarkus-server is vulnerable to improper authorization. A remote attacker is able to add users to the master realm without respective permission due to the lack of required validations in createMasterRealm function...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

Input validation

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

CVE-2021-29859

CVE-2021-29859 affects IBM Cloud Pak for Business Automation, specifically IBM ICP4A - User Management System component in versions 21.0.3 (21.0.3-IF008), 21.0.2 (21.0.2-IF009), and 21.0.1 (21.0.1-IF007) and earlier. The issue arises from insufficient input/validation and logout handling, allowin...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)

Exploit Tile: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery CSRF Exploit Author: LiquidWorm enteliTouch CSRF CSRF Add User:...

CVE-2022-29287

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights default is Administrator to export the user options of any user, even ones with higher privileges like Global Administrators than the current user. The exported XML...

Design/Logic Flaw

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights default is Administrator to export the user options of any user, even ones with higher privileges like Global Administrators than the current user. The exported XML...

CVE-2022-29287

CVE-2022-29287 affects Kentico CMS before 13.0.66, where a user with management rights (default Administrator) can export the options of any user, including higher-privileged accounts (e.g., Global Administrators). The exported XML can include every option of the targeted user, including the hash...

Stored XSS on add Group Name

Description XSS found on function add Group Name on User Management module at Organizr 2.1.1810. Proof of Concept 1 Go to User Management - Manage Group 2 Add new group 3 Insert payload on "Group Name" field then Add Group Payload 1 "alert"xss-here"; Screenshot 1 xss-triger 2 version 3 document...

Aethon TUG Home Base Server 安全漏洞

Aethon TUG Home Base Server is a robotics server from Aethon, Inc. It is used to control and communicate with autonomous mobile robots. Aethon TUG Home Base Server has a security vulnerability that can be exploited by an unauthenticated attacker to arbitrarily add new users with administrative...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

Incapptic Connect 安全漏洞

Incapptic Connect is an application plugin. A security vulnerability exists in Incapptic Connect version 1.40.1, which originates from a non-administrative user with user management privileges being able to elevate their privileges to an administrator user via the password reset feature...

PT-2022-15535 · Unknown · Incapptic Connect

Name of the Vulnerable Software and Affected Versions: Incapptic Connect versions prior to 1.40.1 Description: A non-admin user with user management permission can escalate their privilege to an admin user via the password reset functionality. Recommendations: For versions prior to 1.40.1, update...

LDAP shell - AD ACL Abuse

This repository contains a small tool inherited from ldapshell https://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/ldapshell.py. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the dependencies and you should be good to...