PT-2022-23015 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.8 Description: The issue is related to incorrect access control for admin functionality at the "/users" endpoint. This lack of access control can be leveraged to perform a cross-site scripting attack...

CVE-2022-30842

Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting XSS via /ctpms/classes/Users.php?f=save, firstname...

CVE-2022-28962

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=deleteclient...

PT-2022-16877 · Statamic · Statamic

Name of the Vulnerable Software and Affected Versions: Statamic versions prior to 3.2.39 Statamic versions prior to 3.3.2 Description: The issue allows an attacker to confirm a single character of a user's password hash using a specially crafted regular expression filter in the "users" endpoint o...

PT-2021-15716

Name of the Vulnerable Software and Affected Versions: User Profile Picture WordPress plugin versions prior to 2.5.0 Description: The issue concerns the REST API endpoint "get users" in the User Profile Picture WordPress plugin, which returned excessive information to users with the upload files...

CVE-2021-26593

In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secret can be regenerated. NOTE...

CVE-2020-23451

Spiceworks Version = 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function...

PT-2020-15561

Name of the Vulnerable Software and Affected Versions Spiceworks versions prior to 7.5.00108 Description The issue allows for privilege escalation via the "/settings/v1/users" API endpoint. This can be exploited due to a CSRF flaw. Recommendations For versions prior to 7.5.00108, update to versio...

PT-2020-6641 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.11.6 GitLab versions prior to 13.12.6 GitLab versions prior to 14.0.2 Description: The issue is related to a reflected cross-site script vulnerability. It allows a remote attacker to compromise data integrity by...

Harbor User Enumeration Vulnerability

Harbor is an open source trusted cloud native registry. The product is primarily used to store, sign and scan container images for vulnerabilities. A security vulnerability exists in the '/users' API endpoint in Harbor. An attacker could use the vulnerability to bypass restrictions on this endpoi...

WordPress Information Disclosure Vulnerability (CNVD-2017-00618)

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php file...

DEBIAN-CVE-2017-5487

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...

PT-2009-4245 · Ulteo · Ulteo Open Virtual Desktop

Name of the Vulnerable Software and Affected Versions: Ulteo Open Virtual Desktop version 1.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several API endpoints, including...