2161 matches found
CVE-2021-24170
CVE-2021-24170 affects the WordPress plugin User Profile Picture (versions before 2.5.0). The REST API endpoint get_users exposes password hashes, hashed activation keys, usernames, emails, and other sensitive information to users with the upload_files capability. Root cause: overly verbose respo...
EUVD-2021-11084
The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...
PT-2021-15716
Name of the Vulnerable Software and Affected Versions: User Profile Picture WordPress plugin versions prior to 2.5.0 Description: The issue concerns the REST API endpoint "get users" in the User Profile Picture WordPress plugin, which returned excessive information to users with the upload files...
The vulnerability of the Windows Operating System’s User Profile Service allows a perpetrator to trigger a service failure.
The vulnerability of the Windows User Profile Service is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the User Profile Service (ProfSvc) on Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the User Profile Service ProfSvc in Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their own privileges...
Moodle Cross-Site Scripting Vulnerability (CNVD-2021-28734)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in moodle that originates in the user profile field. No detailed vulnerability details are...
Microsoft Windows User Profile Service Directory Junction Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...
Cross-Site Scripting (XSS)
moodle/moodle is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in user's browser via by storing a malicious payload within the ID number from the user profile field...
CVE-2021-20279
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...
CVE-2021-20279
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...
CVE-2021-20279
CVE-2021-20279 affects Moodle before versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17, where the id number user profile field sanitization allows stored XSS. The vulnerability is a result of insufficient sanitization of the user profile ID field, enabling stored XSS attacks. The connected documents indi...
CVE-2021-20279
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...
Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure
Exploit Title: Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure Date: 04-02-2021 Exploit Author: Berkan Er Vendor Homepage: https://www.sonlogger.com/ Version: 4.2.3.3 Tested on: Windows 10 Enterprise x64 Version 1803 A remote attacker can be create an user with SuperAdmin...
Moodle 跨站脚本漏洞
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in moodle that originates in the user profile field. No detailed vulnerability details are...
Microsoft Windows User Profile Service Directory Junction Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the User Profile...
CVE-2021-26886
User Profile Service Denial of Service Vulnerability...
CVE-2021-26886
User Profile Service Denial of Service Vulnerability...
CVE-2021-26873
Windows User Profile Service Elevation of Privilege Vulnerability...
