30 matches found
PortSwigger Web Security: A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts
The vulnerability allowed a user with only the "MODIFYSETTINGS" permission to take over any user accounts. By configuring the email settings to use a public SMTP server, the attacker could capture the email and password reset link whenever an administrator or user with permissions to edit or add...
Session fixation
IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657...
CVE-2022-31478
The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function...
ILIAS plugin UserTakeOver 安全漏洞
ILIAS is an open source learning management system. A security vulnerability exists in the ILIAS plugin UserTakeOver versions prior to 4.0.1. An attacker exploited the vulnerability to list all users via the search function...
GHSA-5GH9-G62H-F35M Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers
Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator...
MobiSoft MobiPlus 安全漏洞
MobiSoft MobiPlus is a leading integrated solution for activities in the field of sales and distribution of MobiSoft Israel. MobiSoft MobiPlus suffers from a security vulnerability that originates from a MobiSoft user takeover and improper handling of url parameters. The vulnerability can be...
CVE-2022-22792
MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&GridName=Users...
CVE-2020-6844
In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts...
Buffer overflow
An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...
