CVE-2019-18380: Improper Authentication

Symantec Industrial Control System Protection ICSP, versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication...

Magento Authorization Issues Vulnerabilities

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 prior to 2.1.18, version 2.2 prior to 2.2.9, and version 2...

Cybozu Garoon Privilege Access Control Issue Vulnerability (CNVD-2019-12703)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A vulnerability exists in the privilege access control issue in Cybozu Garoon versions 4.0.0 through 4.10.1. The...

NetSoft Zhicheng Classifieds website system suffers from an over-authorized access vulnerability

NetSoft Zhicheng classifieds website system is a php mysql based website building system. Netsoft Zhicheng classifieds website system has an override access vulnerability, which can be exploited by attackers to modify other users' information...

The vulnerability of Microsoft Exchange Server’s mail server, related to insecure management of privileges, allows a hacker to modify user profile data.

The vulnerability of Microsoft Exchange Server is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify user profiles through a specially crafted request...

Insecure Direct Object Reference

flarum/core is vulnerable to insecure direct object reference. An attacker is able to exploit the vulnerability to modify user information which can possibly lead to a full account takeover...

CVE-2018-1000507: Cross-Site Request Forgery (CSRF)

WP User Groups version 2.0.0 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in allows anybody to modify user groups and types. This attack appear to be exploitable via Admin must click on link. This vulnerability appears to have been fixed in 2.1.1...

CVE-2018-0590: Undefined Security Weakness

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

Linux Kernel Denial of Service Vulnerability (CNVD-2018-10153)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. Linux Kernel suffers from a ptrace error handling denial of service vulnerability. A local user can exploit this...

UBUNTU-CVE-2018-1000199

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modifyuserhwbreakpoint that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in...

CVE-2018-6888: Cross-Site Request Forgery (CSRF)

An issue was discovered in Typesetter 5.1. The User Permissions page aka Admin/Users suffers from critical flaw of Cross Site Request forgery: using a forged HTTP request, a malicious user can lead a user to unknowingly create / delete or modify a user account due to the lack of an anti-CSRF toke...

CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery CSRF vulnerability...

Improper access control

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...

CVE-2017-15052

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...

Unauthorized Access Vulnerability in Goodbody Knowledge Android APP of Tongfang Co.

Good Body Knowledge Android App is a software to detect the health data in your body. There is an override access vulnerability in the Good Body Knowledge Android APP of Tongfang Co. The attacker registers and logs into the system while grabbing packets and modifying the user ID to query any user...

TouTou Shared Bike Android APP has an override access vulnerability

TouTou Shared Bike Android APP is a shared bike travel software for cities. TouTou Shared Bicycle Android APP has an override access vulnerability. After registering and logging into the system, the attacker can modify the user ID by grabbing packets to view any account information, including:...

Microtransit EV Android App has an override access vulnerability

Microbus EV APP is a car time-share rental service software. Microtransit EV Android APP has an override access vulnerability. After logging into the system, an attacker can view any account information, including user's name, cell phone number, ID number, account amount and other sensitive...

Shenzhen Yuanzheng Technology X431-PRO 3S Android APP has an overstepping vulnerability

X431-PRO 3S APP is a vehicle fault detection system. The X431-PRO 3S Android APP of Shenzhen Yuanzheng Technology has an overstepping vulnerability. The attacker logs into the system and modifies the user ID by grabbing packets to view any account information, including: user name, cell phone...

CVE-2016-4834: Undefined Security Weakness

modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors...

PT-2015-7529

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to hijack user authentication for certain requests, potentially causing a denial of service or modifying user account details. This can be achieved via craft...