CVE-2024-49273

Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid.This issue affects ProfileGrid: from n/a through 5.9.3...

CVE-2024-49273 WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability

Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities.This issue affects ProfileGrid : from n/a through = 5.9.3...

CVE-2024-49273

CVE-2024-49273 is a CSRF vulnerability in ProfileGrid – User Profiles, Groups and Communities (WordPress) affecting versions ≤ 5.9.3. Root cause: missing/insufficient authorization validation for cross-site requests. Impact: Cross-site request forgery allowing unauthorized actions by authenticate...

Data lost upon configuring folder redirection for existing user profiles

When Desktop folder redirection is configured for existing user profiles, User Profile Management UPM only transfers individual files from the user profile's Desktop folder to the redirected location, resulting in the deletion of all subfolders and their contents...

PT-2024-39964 · Unknown +1 · Cert Vince +1

Name of the Vulnerable Software and Affected Versions: CERT VINCE versions prior to 3.0.8 Description: A potential denial-of-service DoS issue exists due to the ability of an authenticated administrative user to inject an arbitrary pickle object into a user’s profile. This action may lead to a Do...

GHSA-H5Q3-FJP4-2X7R MantisBT vulnerable to information disclosure with user profiles

Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. Impact Disclosure of private system profiles: Platform, OS, OS version, Description. Patches -...

CVE-2024-45792

Mantis Bug Tracker MantisBT is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4...

CVE-2024-45792 MantisBT vulnerable to information disclosure with user profiles

Mantis Bug Tracker MantisBT is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4...

CVE-2024-45792 MantisBT vulnerable to information disclosure with user profiles

Mantis Bug Tracker MantisBT is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4...

SolarWinds Serv-U 15.2.0 < 15.2.3

The version of SolarWinds Serv-U installed on the remote host is prior to 15.2.2 HF1. It is, therefore, affected by a vulnerability as referenced in the serv-u1522hf1 advisory. - In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users'...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CS-Cart 安全漏洞

CS-Cart is an e-commerce platform from CS-Cart Inc. A security vulnerability exists in CS-Cart version 4.16.1. An attacker exploited the vulnerability to change arbitrary user account profiles via a specially crafted request...

PT-2024-12110 · Unknown · Cs-Cart Multivendor

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: An issue in CS-Cart MultiVendor allows attackers to alter arbitrary user account profiles via crafted post requests. Recommendations: For CS-Cart MultiVendor version 4.16.1, consider disabling...

CVE-2024-8246

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress (BuddyForms) has a privilege-escalation vulnerability in all versions up to and including 2.8.11. The root cause is inadequate restriction of what users can ...

CVE-2024-8246 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

WordPress plugin Community by PeepSo – Social Network, Membership, Registration, User Profiles 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin...

CVE-2024-25090 Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted...