2209 matches found
PT-2020-16136 · Moodle · Moodle
Name of the Vulnerable Software and Affected Versions: Moodle versions 3.9 through 3.9.1 Description: The issue concerns a stored XSS risk due to insufficient sanitizing in the moodlenetprofile user profile field. This poses a risk as it can lead to the execution of malicious scripts stored in th...
Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting
Exploit Title: Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting Date: 04-12-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.formalms.org/download.html Software Link: https://www.formalms.org/ Version: 2.3 Tested on: Windows 10/Kali Linux...
Forma LMS 2.3 Cross Site Scripting
Exploit Title: Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting Date: 04-12-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.formalms.org/download.html Software Link: https://www.formalms.org/ Version: 2.3 Tested on: Windows 10/Kali Linux...
eClass LMS 2.6 Shell Upload
...
The vulnerability of the Windows User Profile Service (ProfSvc) on Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Windows User Profile Service ProfSvc on Windows operating systems is related to improper handling of network connections. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...
PT-2020-5730 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a denial-of-service vulnerability in the User Profile Service of Windows operating systems, caused by a buffer overflow in memory. This vulnerability can be exploite...
Microsoft Windows User Profile Service Arbitrary File Deletion Vulnerability
This vulnerability allows local attackers to delete arbitrary files on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within handling of the...
CVE-2020-16940
An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles junction points. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first...
Privilege escalation
An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles junction points. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first...
Description of the security update for SharePoint Enterprise Server 2016: October 13, 2020
None None...
Windows - User Profile Service Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles junction points. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first...
PT-2020-4375 · Microsoft · Windows User Profile Service +1
Name of the Vulnerable Software and Affected Versions: Windows User Profile Service ProfSvc affected versions not specified Description: The issue is related to the improper handling of junction points by the Windows User Profile Service ProfSvc, which can allow an attacker to elevate their...
KLA11978 Multiple vulnerabilities in Microsoft Products (ESU)
Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges, execute arbitrary code, cause denial of service, spoof user interface. Below is a complete list of vulnerabilities...
Code injection
A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data. To exploit the vulnerability, an attacker would need to be authenticated on an affected...
CVE-2020-24194
A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...
openSUSE Security Update : MozillaFirefox (openSUSE-2020-1384)
This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 78.2.0 ESR - Fixed: Various stability, functionality, and security fixes - Mozilla Firefox ESR 78.2 MFSA 2020-38 bsc1175686 - CVE-2020-15663 bmo1643199 Downgrade attack on the Mozilla Maintenance Servic...
PT-2020-4036 · Microsoft · Sharepoint Foundation +1
Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Foundation affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: A tampering issue exists due to...
CVE-2020-25115
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...