CVE-2023-0872

OpenNMS Horizon CVE-2023-0872 affects Horizon REST API users endpoint in Horizon 31.0.8 and older than 32.0.2, enabling privilege elevation (to admin) via REST. The issue stems from role escalation between ROLE_REST and ROLE_ADMIN when accessing /rest/users, with confirmed guidance that upgrading...

PT-2023-16576 · Opennms · Opennms Horizon +1

Name of the Vulnerable Software and Affected Versions: OpenMNS Horizon versions 31.0.8 through 32.0.2 Meridian affected versions not specified Description: The Horizon REST API includes a "users" endpoint that is vulnerable to elevation of privilege. The solution is to upgrade to a newer version...

CVE-2023-3847 mooSocial mooDating URL users cross site scripting

A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to...

PT-2023-26457 · Unknown · Moosocial Moodating

Name of the Vulnerable Software and Affected Versions: mooSocial mooDating version 1.2 Description: A problematic vulnerability was found in the URL Handler component, affecting unknown code of the file /users. This issue leads to cross site scripting and can be initiated remotely. Recommendation...

OpenNMS Horizon 安全漏洞

OpenNMS Horizon is an open source solution from OpenNMS, Inc. that helps you visualize and monitor everything on your local and remote networks. A security vulnerability exists in OpenNMS Horizon that stems from the fact that the Horizon REST API includes an endpoint named users that is vulnerabl...

SUSE CVE-2014-3654

Multiple cross-site scripting XSS vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network RHN Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 kickstart/cobbler/CustomSnippetList.do, 2...

CVE-2022-4417

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users...

PT-2022-28272 · Pageflow · Pageflow

Name of the Vulnerable Software and Affected Versions: Pageflow versions prior to 14.5.2 Pageflow versions prior to 15.7.1 Description: The issue allows attackers to update membership objects associated with their own account to be associated with a different account, potentially compromising all...

CVE-2022-35909

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality...

CVE-2022-35909

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality...

CVE-2022-35909

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality...

PT-2022-23015 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.8 Description: The issue is related to incorrect access control for admin functionality at the "/users" endpoint. This lack of access control can be leveraged to perform a cross-site scripting attack...

Jellyfin 安全漏洞

Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex, and can serve media from dedicated servers to end-user devices through multiple applications. A security vulnerability exists in versions of...

CVE-2022-30842

Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting XSS via /ctpms/classes/Users.php?f=save, firstname...

CVE-2022-28962

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=deleteclient...

PT-2022-16877 · Statamic · Statamic

Name of the Vulnerable Software and Affected Versions: Statamic versions prior to 3.2.39 Statamic versions prior to 3.3.2 Description: The issue allows an attacker to confirm a single character of a user's password hash using a specially crafted regular expression filter in the "users" endpoint o...

PT-2021-15716

Name of the Vulnerable Software and Affected Versions: User Profile Picture WordPress plugin versions prior to 2.5.0 Description: The issue concerns the REST API endpoint "get users" in the User Profile Picture WordPress plugin, which returned excessive information to users with the upload files...

CVE-2020-23451

Spiceworks Version = 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function...

PT-2020-15561

Name of the Vulnerable Software and Affected Versions Spiceworks versions prior to 7.5.00108 Description The issue allows for privilege escalation via the "/settings/v1/users" API endpoint. This can be exploited due to a CSRF flaw. Recommendations For versions prior to 7.5.00108, update to versio...

PT-2020-6641 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.11.6 GitLab versions prior to 13.12.6 GitLab versions prior to 14.0.2 Description: The issue is related to a reflected cross-site script vulnerability. It allows a remote attacker to compromise data integrity by...