PT-2018-13094 · My Little Forum · My Little Forum

Name of the Vulnerable Software and Affected Versions: my little forum version 2.4.12 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, which can lead to the deletion of users. Recommendations: For my little forum version 2.4.12, update to a newer version that contains a...

my little forum Cross-Site Request Forgery Vulnerability

my little forum is a set of Internet forum applications based on PHP and MySQL. The application uses a traditional tree view to display information and supports image uploading, template engine, BB code and emoticons. A cross-site request forgery vulnerability exists in my little forum version...

Design/Logic Flaw

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-12971

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-12971

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-12971

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-1000193

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

Cross site request forgery (csrf)

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

CVE-2018-11127 pertains to the e107 CMS, targetting version 2.1.7. The issue is a Cross-Site Request Forgery (CSRF) that allows arbitrary user deletion. Root cause and impact are documented across multiple sources (including Red Hat and CNVD). According to CVSS, the vulnerability is network-expos...

CVE-2016-8629

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

Design/Logic Flaw

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

CVE-2016-8629

CVE-2016-8629 affects Red Hat Keycloak prior to version 2.4.0. The vulnerability is a failure to properly enforce permissions when handling service account user deletion requests sent to the REST server. An attacker with service account authentication could bypass normal permissions and delete us...

CVE-2016-8629

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

CVE-2017-15052

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...

CVE-2017-1000142

The CVE affects Mahara releases prior to 1.8.7, 1.9.5, 1.10.3 and 15.04.0 (i.e., Mahara 1.8, 1.9, 1.10 series and 15.04) where users could delete their submitted pages via URL manipulation. The root cause is not explicitly detailed in the provided documents beyond this behavior. The references co...

Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in the administration user deletion resource ...

CVE-2017-14587

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the uname parameter...

CVE-2017-14587

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the uname parameter...