CVE-2023-36100: Improper Privilege Management

An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser...

PT-2022-27883

Name of the Vulnerable Software and Affected Versions nbnbk affected versions not specified Description The issue is related to an arbitrary file upload vulnerability. This vulnerability is exploited via the /api/User/download img API endpoint. Recommendations At the moment, there is no informati...

CVE-2022-46493

Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/downloadimg...

CVE-2022-46493: Unrestricted Upload of File with Dangerous Type

Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/downloadimg...

CVE-2022-39307

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the "/api/user/password/sent-reset-email" URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leak...

PT-2022-7306

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 8.5.15 Grafana versions 9.0.0 through 9.2.3 Description Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the...

CVE-2022-35135: Improper Authentication

Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/...

CVE-2021-37791: Undefined Security Weakness

MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin...

PT-2022-11988

Name of the Vulnerable Software and Affected Versions KONGA version 0.14.9 Description The issue allows attackers to escalate privileges from higher privilege users to full administration access. This is achieved through a crafted condition, as demonstrated by the "/api/user/ID" endpoint at the...

CVE-2021-36310: Protection Mechanism Failure

Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged API user may potentially exploit this vulnerability, leading to a denial of service...

CVE-2021-21600

Dell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentially exploit this vulnerability via the web and desktop user interfaces, leading to denial of service in the manageability path...

Design/Logic Flaw

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for extern...

CVE-2021-32739

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a...

CVE-2021-32739: Privilege Defined With Unsafe Actions

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a...

PYSEC-2021-67

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...

CVE-2020-36191

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...

CVE-2020-36191: Cross-Site Request Forgery (CSRF)

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...

Unspecified Vulnerability in HCL AppScan (CNVD-2021-13713)

HCL AppScan is a suite of dynamic analysis testing tools from HCL India. The tool is mainly used for web security testing. A security vulnerability exists in HCL AppScan Enterprise that stems from the use of broken or risky encryption algorithms to store REST API user details. No detailed...

CVE-2019-4325

"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."...

vBulletin 5.5.x < 5.5.2 Patch Level 2 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of vBulletin hosted on the remote web server is 5.5.x 5.5.2 Patch Level 2, 5.5.3 5.5.3 Patch Level 2 or 5.5.4 5.5.4 Patch Level 2. It is, therefore, affected by multiples vulnerabilities : - A SQL injection vulnerability v...