wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly. While creating a new role in the domain mode via the admin console, it is possible to add a payload in the name field, leading to a Cross-site scripting attack XSS. The highest threat from this vulnerability is to confidentiality and integrity...

wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly. While creating a new role in the domain mode via the admin console, it is possible to add a payload in the name field, leading to a Cross-site scripting attack XSS. The highest threat from this vulnerability is to confidentiality and integrity...

wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly. While creating a new role in the domain mode via the admin console, it is possible to add a payload in the name field, leading to a Cross-site scripting attack XSS. The highest threat from this vulnerability is to confidentiality and integrity...

wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly. While creating a new role in the domain mode via the admin console, it is possible to add a payload in the name field, leading to a Cross-site scripting attack XSS. The highest threat from this vulnerability is to confidentiality and integrity...

CVE-2021-3536

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity...

CVE-2021-3536

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity...

PT-2021-20899 · Red Hat · Wildfly

Name of the Vulnerable Software and Affected Versions: Wildfly versions prior to 23.0.2.Final Description: A flaw was found in Wildfly while creating a new role in domain mode via the admin console, allowing a payload to be added in the name field, leading to XSS. This affects Confidentiality and...

GaussDB Kernel: Checking the CREATEROLE Permission

Only the role with the CREATEROLE permission can create, modify, or delete other roles. Such a role can also grant permissions to or revoke permissions of other roles. To avoid arbitrary permission granting, delete roles that do not require the CREATEROLE permission. Copyright C 2020 Greenbone...

GaussDB Kernel: Configuring the Validity Period of User Roles

During role creation, the keyword VALID BEGIN is used to set the role validity start time and VALID UNTIL to set the end time. If these two keywords are not set, roles are permanently valid. The role expiration time on each node in the GaussDB Kernel cluster depends on the OS clock on each node...

iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation

Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation Date: 2020-07-16 Exploit Author: LiquidWorm Vendor Homepage: http://www.yerootech.com Version: 6.2 iDS6 DSSPro Digital Signage System 6.2 Improper Access Control Privilege Escalation Vendor:...

WordPress ConvertPlus plugin <= 3.4.2 - Unauthenticated Arbitrary User Role Creation vulnerability

Unauthenticated Arbitrary User Role Creation vulnerability found by WordFence in WordPress ConvertPlus plugin versions = 3.4.2. Solution Update the WordPress ConvertPlus plugin to the latest available version at least 3.4.3...

ConvertPlus <= 3.4.2 - Unauthenticated Arbitrary User Role Creation

The convertplug WordPress plugin was affected by an Unauthenticated Arbitrary User Role Creation security vulnerability...

New Relic: CSRF at adding new role (user-management.service.newrelic.com)

Hey New Relic security team, I have discovered a CSRF-vulnerability allowing attacker to create new custom role on behalf of victim. The role creation endpoint does not implement correct CSRF-protection so it can be bypassed. The exploited works fine at least at latest Firefox browser. Steps to...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2017-7314

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2017-7314

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2010-1616

Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability...

CVE-2010-1616

CVE-2010-1616 affects Moodle 1.8.x and 1.9.x up to 1.9.7/1.9.8, where restoring a course can create new roles, enabling teachers to create new accounts without moodle/user:create capability. Root cause: role creation during course restore. Impact: potential unauthorized account creation by teache...