121 matches found
CVE-2021-32657 Malicious user could break user administration page
Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The...
CVE-2021-32657
CVE-2021-32657 affects Nextcloud Server: in versions prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user could break the user administration page, preventing admins from managing users. The issue is fixed in 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command...
Malicious user could break user administration page
None...
PT-2021-19835 · Nextcloud +1 · Nextcloud Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 10.0.11 Nextcloud Server versions prior to 20.0.10 Nextcloud Server versions prior to 21.0.2 Description: A malicious user may be able to break the user administration page, disallowing administrators to...
Bitweaver 跨站脚本漏洞
Bitweaver is an open source content management system CMS. A security vulnerability exists in Bitweaver version 3.1.0, which can be exploited by remote attackers to inject JavaScript via the user admin edit group.php URI...
ZOHO ManageEngine Remote Access Plus Injection Vulnerability
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...
CVE-2019-16268
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...
Design/Logic Flaw
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...
CVE-2019-16268
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...
CVE-2019-16268
Zoho ManageEngine Remote Access Plus 10.0.259 is affected by an HTML injection vulnerability in the Admin - User Administration screen (userMgmt.do?actionToCall=ShowUser). The issue concerns the Description field and is documented across multiple sources (NVD, Red Hat advisory, CNVD). No exploit ...
ZOHO ManageEngine Remote Access Plus 注入漏洞
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...
SolarWinds Database Performance Analyzer Cross-Site Scripting Vulnerability
SolarWinds Database Performance Analyzer is a set of database performance analyzers from SolarWinds Solarwinds, USA. The product is used for SQL query performance monitoring, analysis and tuning and so on. A cross-site scripting vulnerability exists in SolarWinds Database Performance Analyzer DPA...
CVE-2018-16243
SolarWinds Database Performance Analyzer DPA 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen...
CVE-2020-13827
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
CVE-2020-13827
CVE-2020-13827 affects phpList prior to version 3.5.4, with an XSS vulnerability exploitable via /lists/admin/user.php and /lists/admin/users.php. Connected sources corroborate that the flaw stems from inadequate validation of client-side data in these admin endpoints. The practical impact is cli...
CVE-2020-11659
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action...
Improper access control
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action...
CVE-2020-11659
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action...
