287 matches found
CVE-2022-31294: Cross-Site Request Forgery (CSRF)
An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...
CVE-2021-44096
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profileaction - updateuser. This allows a remote attacker to compromise Application SQL database...
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel SQL Injection Vulnerability
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel is a user registration and login system with an administrative panel from EGavilan Media. EGavilan Media User-Registration -and-Login-System-With-Admin-Panel version 1.0 contains a SQL injection vulnerability, which stems from...
PT-2022-11985
Name of the Vulnerable Software and Affected Versions EGavilan Media User-Registration-and-Login-System-With-Admin-Panel version 1.0 Description The issue allows a remote attacker to compromise the application's SQL database via SQL Injection in the profile action - update user function. This can...
CVE-2022-28986
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references IDOR vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts...
CVE-2022-28986
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references IDOR vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts...
QA Report
Paladin Contest March 31, 2022 @securerodd Non-Critical 1. Inconsistent Removal of Bonus Multiplier The bonus multipliers userCurrentBonusRatiouser and userBonusRatioDecreaseuser are zeroed out in the kickaddress user, address kicker and unlockaddress user functions where an empty lock is set...
CVE-2022-22111
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged use...
Authorization
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged use...
CVE-2022-22110 DayByDay CRM - Weak Password Requirements in Update User
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’...
CVE-2020-35243
Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb...
CVE-2020-35273
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery CSRF to remotely gain privileges in the User Profile panel. An attacker can update any user's account...
Egavilanmedia User Registration & Login System Cross-Site Request Forgery Vulnerability
Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A cross-site request forgery vulnerability exists in EgavilanMedia User Registration & Login System with Admin Panel 1.0, which allows to remotely obtain privileges to ...
CVE-2020-28930
A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...
PT-2020-17061
Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php allows an authenticated attacker to inject a JavaScript payload in the user...
EPSON EPS TSE Server Cross-Site Scripting Vulnerability
EPSON EPS TSE Server is a server from EPSON Japan. A cross-site scripting vulnerability exists in EPSON EPS TSE Server 8 that stems from a cross-site scripting XSS issue with the update user and delete user functions in settings users.php, which could be exploited by authenticated attackers to...
Red Hat Keycloak Security Vulnerability
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in keycloak that stems from the Account REST API that can update user metadata attributes...
Microsoft Windows Multiple Vulnerabilities (KB4586830)
This host is missing a critical security update according to Microsoft KB4586830 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
BSA Radar 1.6.7234.24750 Cross Site Scripting
Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Date: 2020-06-22 Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X...