The vulnerability in the implementation of the user account profile picture service, User Profile Service (ProfSvc) of the Windows User Profile Service, on Microsoft Windows operating systems, allows a perpetrator to escalate their privileges.

The vulnerability of the User Account Profile Picture implementation in the Windows User Profile Service ProfSvc on Microsoft Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2021-20760

Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profile without the appropriate privilege...

CVE-2021-20760

Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profile without the appropriate privilege...

Input validation

Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profile without the appropriate privilege...

CVE-2021-20760

Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profile without the appropriate privilege...

CVE-2021-20760

CVE-2021-20760 affects Cybozu Garoon 4.0.0–5.0.2. It is an improper input validation vulnerability in the User Profile that allows a remote authenticated attacker to alter User Profile data without the proper privilege. Connected sources confirm the affected product/versions and the impact (unaut...

CVE-2021-24527

Summary: CVE-2021-24527 affects the WordPress plugin Profile Builder (before 3.4.9). Multiple connected sources confirm an improper authentication in the password reset flow that lets an unauthenticated user reset the password of the blog’s administrator, enabling full site compromise and adminis...

CVE-2021-34484

Windows User Profile Service Elevation of Privilege Vulnerability...

CVE-2021-34484

Windows User Profile Service Elevation of Privilege Vulnerability...

Privilege escalation

Windows User Profile Service Elevation of Privilege Vulnerability...

CVE-2021-34484 Windows User Profile Service Elevation of Privilege Vulnerability

...

CVE-2021-34484

CVE-2021-34484 is a Windows User Profile Service local privilege escalation caused by a race condition in CreateDirectoryJunction() that allowed a logged-on user to influence profile handling and load a malicious DLL with SYSTEM privileges. The vulnerability was initially patched but later bypass...

CVE-2021-34484 Windows User Profile Service Elevation of Privilege Vulnerability

...

CVE-2021-34484

Windows User Profile Service Elevation of Privilege Vulnerability Recent assessments: ccondon-r7 at March 29, 2022 12:10pm UTC reported: This bug was evidently used by LAPSUS$ in the wild as part of the attack on Okta. gwillcox-r7 at March 30, 2022 4:21pm UTC reported: This bug was evidently used...

Microsoft Windows User Profile Service Directory Junction Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the User Profile...

Microsoft Windows User Profile Service Directory Junction Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the User Profile...

Windows User Profile Service Elevation of Privilege Vulnerability

...

PT-2021-3900 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions prior to the fixed version Description: The issue is related to the Windows User Profile Service and is associated with insufficient access restrictions. It allows an attacker to elevate their privileges. The vulnerability ca...

CVE-2021-24522

CVE-2021-24522 affects ProfilePress (formerly WP User Avatar) for WordPress, before version 3.1.11. The tabbed login/register widget is vulnerable to unauthenticated reflected XSS due to improper escaping, with some cases enabling replication via $_GET because $_POST values were mapped to $_GET. ...

Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

✍️ Description Attacker is able to change a user profile state to visible if a logged in user visits attacker website. 🕵️‍♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check your profile state changed to visible history.pushState'', '', '/'...