PT-2021-15716

Name of the Vulnerable Software and Affected Versions: User Profile Picture WordPress plugin versions prior to 2.5.0 Description: The issue concerns the REST API endpoint "get users" in the User Profile Picture WordPress plugin, which returned excessive information to users with the upload files...

CVE-2021-21396

wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the "GET /users/list-clients" endpoint. The endpoint could be used by any logged in user who coul...

CVE-2021-21396: Exposure of Sensitive Information to an Unauthorized Actor

wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the GET /users/list-clients endpoint. The endpoint could be used by any logged in user who could...

PT-2021-14474

Name of the Vulnerable Software and Affected Versions wire-server versions 2021-02-16 through 2021-03-02 Description The client metadata of all users was exposed in the "GET /users/list-clients" endpoint. This endpoint could be used by any logged-in user to request client details of any other use...

MantisBT SQL注入漏洞

MantisBT is a lightweight, free and open source, web-based defect tracking system. A SQL injection vulnerability exists in the "access" parameter of the mcprojectgetusers function in MantisBT 2.24.3. An attacker can exploit this vulnerability via API SOAP to conduct SQL injection attacks...

PT-2020-17005

Name of the Vulnerable Software and Affected Versions MantisBT version 2.24.3 Description The issue is related to SQL Injection that can occur in the access parameter of the mc project get users function through the API SOAP. Recommendations For MantisBT version 2.24.3, consider disabling the mc...

PT-2019-16746

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Description A vulnerability was found where the get with capability join and get users by capability functions did not account for context freezing when checking user capabilities. Recommendations For versions...

PT-2018-17052

Name of the Vulnerable Software and Affected Versions weblizar-pinterest-feeds plugin version 1.1.1 Description A security issue was found in the weblizar-pinterest-feeds plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the "weblizar pffree settings save...

Frappe frappe.share.get_users SQL Injection Vulnerability

Frappe is a WEB application. Frappe frappe.share.getusers suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...