CVE-2021-29773: Authorization Bypass Through User-Controlled Key

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 202865...

CVE-2021-29773

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 202865...

CVE-2021-3352: Undefined Security Weakness

The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access view and modify user data without authorization due to improper handling of tokens...

CVE-2021-27402: Improper Limitation of a Pathname to a Restricted Directory

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

uListing < 2.0.6 - Modify User Roles via CSRF

An Add/Edit User Roles via CSRF vulnerability was discovered in the plugin. Missing WPNonce security tokens https://codex.wordpress.org/WordPressNonces . PoC | CSRF | Add/Edit User Roles: POST /wp-admin/admin-ajax.php HTTP/2 Host: example.com Cookie: cookies User-Agent: Mozilla/5.0 Content-Type:...

The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Magento Commerce development and management software platform is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information and modify user data...

CVE-2020-20468

White Shark System WSS 1.3.2 is vulnerable to CSRF. Attackers can use the usereditpassword.php file to modify the user password...

CVE-2021-30167

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices...

Design/Logic Flaw

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions...

CVE-2021-28204

The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

CVE-2021-28199

The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate th...

Buffer overflow

The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate th...

CVE-2020-13421: Undefined Security Weakness

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions...

Logic flaw vulnerability in UCMS (CNVD-2021-19733)

UCMS is a simple web content management system. A logic flaw vulnerability exists in UCMS, which can be exploited by attackers to modify user passwords...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...

CVE-2020-25609: Improper Neutralization of Input During Web Page Generation

The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data...

Logic Flaw Vulnerability in R-SeeNet

R-SeeNet is a monitoring application. It runs on a server and its job is to collect information from routers, store it, process it and present it to the network administrator. R-SeeNet is vulnerable to a logic flaw that can be exploited by an attacker to modify arbitrary user names...

Xi'an Baolian Network Technology Co., Ltd. construction system has logical flaws and vulnerabilities

Xi'an BaiLian Network Technology Co., Ltd. is the first technology company specializing in bearing industry management software development and bearing industry portal design. There is a logic flaw vulnerability in the construction system of Xi'an Bailian Network Technology Co. Attackers take...

CVE-2019-16029

A vulnerability in the application programming interface API of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service DoS condition of the web interface. The...