CVE-2023-46699

Cross-site request forgery CSRF vulnerability exists in the User settings /me page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention...

PT-2023-30163 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A cross-site request forgery CSRF issue exists in the User settings /me page. If a user views a malicious page while logged in, settings may be changed without the user's intention. The API endpoint...

Multiple vulnerabilities in GROWI

Overview GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability in the presentation feature CWE-79 - CVE-2023-42436 Stored cross-site scripting vulnerability in the App Settings /admin/app page and the Markdown Settings...

CVE-2023-21321

In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Design/Logic Flaw

In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21321

CVE-2023-21321 affects Android's Package Manager, enabling cross-user information disclosure due to a missing permission check. The vulnerability allows local information disclosure with no privileges and no user interaction required. The connected sources list this CVE as part of Android 14 secu...

CVE-2023-21321

In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21321

In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

Design/Logic Flaw

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

Cerebrate 安全漏洞

Cerebrate is an open source platform. Designed to act as an interconnection coordinator between trusted contact information providers and other security tools. A security vulnerability exists in Cerebrate version 1.14. An attacker could exploit the vulnerability to change the user settings of oth...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

PT-2023-27927 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate version 1.14 Description: A vulnerability in the UserSettingsController allows authenticated users to change user settings of other users. Recommendations: For Cerebrate version 1.14, consider restricting access to the...

CVE-2023-4382

A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be...

CVE-2023-4382

A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be...

tdevs Hyip Rio 跨站脚本漏洞

tdevs Hyip Rio is an online investment platform from tdevs, Inc. A cross-site scripting vulnerability exists in tdevs Hyip Rio version 2.1, which stems from a cross-site scripting XSS vulnerability in the parameter avatar in file /user/settings...

PT-2023-29001 · Unknown · Tdevs Hyip Rio

Name of the Vulnerable Software and Affected Versions: tdevs Hyip Rio version 2.1 Description: A problematic issue has been found in the Profile Settings component, specifically in the /user/settings file, where the manipulation of the avatar argument leads to cross-site scripting. This issue can...