550 matches found
CVE-2023-27577
Summary : CVE-2023-27577 affects flarum prior to 1.7.0. A compromised admin account can exploit a flaw in the LESS parser to perform path traversal and read sensitive server files (e.g., /etc/passwd) by supplying an absolute path in the custom LESS setting. The vulnerability’s impact depends on t...
CSRF leading to edit admin accounts
Description GET /admin/accounts/id/edit/?activetab=default page is vulnerable to a CSRF attack. Proof of Concept Login as admin. try to edit admin accounts example id=4 Open the following file in the browser. history.pushState'', '', '/'; document.forms0.submit;...
PT-2023-19298 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat server versions prior to 5.2.0 Description: A prototype pollution issue exists that could allow an attacker to achieve remote code execution RCE under the admin account. This vulnerability may affect cloud infrastructure, as any...
CVE-2022-47697
COMFAST Shenzhen Sihai Zhonglian Network Technology Co., Ltd CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeover. Anyone can reset the password of the admin accounts...
CVE-2022-4837
The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...
CVE-2022-4478
The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins...
Failed to add admin accounts to the citrixstorefrontadministrator local group
In the installation log, there are the error： 2022/11/8 16:04:535084Information CreateAccountGroup:GroupName=CitrixStoreFrontAdministrators GroupDesc=允许使用Citrix Replication Service的用户、组和计算机。 2022/11/8 16:04:535084Error AccountHelper::CreateAccountGroup Exception caught creating account group:...
CVE-2022-3926
The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...
CVE-2022-46145
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...
Design/Logic Flaw
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...
PT-2022-26841 · Intelbras · Intelbras Sg 2404 Mr
Name of the Vulnerable Software and Affected Versions: INTELBRAS SG 2404 MR version 20180928-rel64938 Description: The issue allows authenticated attackers to create Administrator accounts arbitrarily through crafted user cookies. Recommendations: For version 20180928-rel64938, consider restricti...
PT-2022-26715 · Dedecms · Dedecms
Name of the Vulnerable Software and Affected Versions: DedeCMS version 6.1.9 Description: A Cross-Site Request Forgery CSRF issue was discovered, allowing attackers to add Administrator accounts arbitrarily and modify Admin passwords. Recommendations: For DedeCMS version 6.1.9, at the moment, the...
CVE-2022-40291
The application was vulnerable to Cross-Site Request Forgery CSRF attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts...
Cross site request forgery (csrf)
The application was vulnerable to Cross-Site Request Forgery CSRF attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts...
PT-2022-25327 · Php Point Of Sale Llc +1 · Php Point Of Sale
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The application is vulnerable to Cross-Site Request Forgery CSRF attacks. This allows an attacker to coerce users into sending malicious requests to the site, potentially leading to...
CVE-2022-36521
Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...
Nortek Control Linear eMerge E3-Series 授权问题漏洞
The Nortek Control Linear eMerge E3-Series is an access control from Nortek Control USA. It allows you to specify which doors a person can use to enter and exit a specified location at a specified time. An authorization issue vulnerability exists in Nortek Control Linear eMerge E3-Series version...
Cross site request forgery (csrf)
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers...
PESCMS 跨站请求伪造漏洞
PESCMS is a content publishing platform. A security vulnerability exists in PESCMS version V2.3.3. An attacker exploited the vulnerability to delete the accounts of admin and other members...