71 matches found
CVE-2026-7884: Improper Neutralization of Input During Web Page Generation
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...
CVE-2025-66304: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack thes...
EUVD-2011-4978
Malware in sbrugna...
EUVD-2009-4109
Malware in sbrugna...
EUVD-2013-5858
Malware in sbrugna...
EUVD-2018-9939
Malware in sbrugna...
EUVD-2020-5595
Malware in sbrugna...
EUVD-2021-2330
Malware in sbrugna...
EUVD-2019-10161
Malware in sbrugna...
EUVD-2021-0106
Malware in sbrugna...
EUVD-2011-1486
Malware in sbrugna...
EUVD-2018-18165
Malware in sbrugna...
EUVD-2024-47884
Malicious code in bioql PyPI...
EUVD-2024-24906
Malicious code in bioql PyPI...
EUVD-2021-6914
Malicious code in bioql PyPI...
CVE-2024-27712
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Account Mangemnt component in the authentication mechanism...
CVE-2024-43784
lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...
CVE-2019-11819
Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...
CVE-2010-5142
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...