208 matches found
U.S. Dept Of Defense: Knowledge Base Articles are Globally Modifiable via ██████
Summary: A user is able to create an account on ██████████ and modify or create any knowledge base articles. This includes articles that have been created by the ██████████ as a canned response to help users with frequently asked questions. Description: Knowledge base articles are used within the...
Automattic: Modify account details by exploiting clickjacking vulnerability on refer.wordpress.com
Summary: I have found that their is no protection for click jacking on refer.wordpress.com so attacker can exploit it to change users details. This clickjacking is on authenticated pages so it is very critical vulnerability. Steps To Reproduce: 1. Create a HTML file with following content...
Symantec Industrial Control System Protection Unauthorized Access Vulnerability
Symantec Industrial Control System Protection ICSP This product provides multidimensional security for industrial control systems and critical infrastructure. A security vulnerability exists in Symantec Industrial Control System Protection ICSP version 6.x.x. An attacker could use this...
CVE-2017-18459
cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...
CVE-2017-18459
cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...
CVE-2017-18459
cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...
CVE-2017-18459
CVE-2017-18459 affects cPanel prior to 62.0.17, where an arbitrary code execution flaw can occur during account modification (SEC-220). Multiple connected sources corroborate that the issue resides in cPanel’s account-modification workflow and allows code execution with local access, high impact,...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
Design/Logic Flaw
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2018-19392
Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...
Cross site request forgery (csrf)
BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account...
CVE-2018-19560
BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account...
BageCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-00135)
BageCMS is a cross-platform content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in BageCMS version 3.1.3. A remote attacker can exploit this vulnerability to modify user accounts with the help of the upload/index.php?r=admini/admin/ownerUpdate U...
NUUO NVRmini2 and NVRsolo
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: NUUO Equipment: NVRmini2, NVRsolo Vulnerabilities: Stack-based Buffer Overflow, Leftover Debug Code 2. RISK EVALUATION Successful exploitation of these...
Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts
plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...
Horse Market Sell & Rent Portal Script Cross-Site Request Forgery Vulnerability
Horse Market Sell & Rent Portal Script is a horse selling website system script. A cross-site request forgery vulnerability exists in Horse Market Sell & Rent Portal Script version 1.5.7. A remote attacker could use this vulnerability to alter information on the target account...