41 matches found
bmc_bladelogic
BMC Bladelogic RSCD exploits remotos para Linux y Windows Cambiar contraseñas, listar usuarios y ejecución remota de código Explotando vulnerabilidades en el agente BMC BladeLogic RSCD CVE-2016-1542 BMC-2015-0010 CVE-2016-1543 BMC-2015-0011 CVE-2016-5063 Publicado en exploit-db BMCrexec.py...
CVE-2026-92754
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...
CVE-2026-92754
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint , where the authorization decorator is commented out. This allows authenticated attackers with low-privilege accounts to enumerate all users and their privilege flags, including superus...
CVE-2026-92754: Missing Authorization
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...
CVE-2026-14931
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...
EUVD-2026-42612
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...
CVE-2026-59206 n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...
CVE-2026-59206
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...
CVE-2025-41077
CVE-2025-41077 affects Viafirma Inbox v4.5.13 with an Insecure Direct Object Reference (IDOR) flaw. The vulnerability allows any authenticated, unprivileged user to list all users, access and modify their data (including emails) and then use password recovery to impersonate other users, potential...
CVE-2022-31478
The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function...
CVE-2025-63221
The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...
EUVD-2006-3929
Malware in sbrugna...
EUVD-1999-0259
Malware in sbrugna...
EUVD-2022-51762
Malicious code in bioql PyPI...
EUVD-2023-36552
Malicious code in bioql PyPI...
CVE-2023-32298
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kathy Darling Simple User Listing plugin = 1.9.2 versions...
CVE-2022-4417
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users...
CVE-2024-42174 HCL MyXalytics is affected by username enumeration vulnerability
HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames...
CVE-2024-42988: Improper Access Control
Lack of access control in ChallengeSolves /api/v1/challenges/ /solves of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+...