VulnCheck KEV: CVE-2016-8870

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting...

Joomla 3.4.4 - 3.6.3 not authorized to create user vulnerability

Author: p0wd3r know Chong Yu 404 security lab Date: 2016-10-26 0x00 vulnerability overview 1. Vulnerability description Joomla is a free open source content management system, recently researchers found in its 3. 4. 4 to 3. 6. 3 version there are two vulnerabilities: CVE-2016-8869, the...

BigTree-CMS 4.2.x < 4.2.3 XSS

Binary data 9554.prm...

BigTree-CMS 4.1.x < 4.1.9 XSS

Binary data 9553.prm...

F5 WebSafe Dashboard Cross-Site Scripting Vulnerability

F5 WebSafe is a suite of web fraud protection solutions from F5 USA. The solution provides malware and fraud detection, client-side mobile threat protection, etc. F5 WebSafe Dashboard is one of the configuration management tools. A cross-site scripting vulnerability exists in F5 WebSafe Dashboard...

The vulnerability of the Windows operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for increased privileges exists in the Windows task scheduler due to incorrect checks for the integrity of tasks. If this vulnerability is exploited successfully, a malicious individual will be able to execute arbitrary code within the context of local system security...

ownCloud: SMB User Authentication Bypass and Persistence

Authentication Bypass ================== The external user authentication app in OwnCloud does not properly authenticate against an SMB server. In it's current implementation, the file owncloud/apps/userexternal/lib/smb.php, line 46-47 uses the command smbclient -L //host/dummy -Uuser%pass, where...

NetCommons Elevation of Privilege Vulnerability

NetCommons is an integrated CMS Content Management System and LMS Learning Management System website maintained by the NetCommons project in Japan. An elevation of privilege vulnerability exists in NetCommons 2.4.2.1 and prior versions. The vulnerability can be exploited to create users with...

The vulnerability of the Isilon operating system OneFS, which allows a hacker to bypass the SmartLock restriction

The vulnerability of the Isilon operating system OneFS is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent the SmartLock restriction by creating a user account and setting up an login session remotely...

CVE-2015-7728

Cross-site scripting XSS vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898...

Cross site scripting

Cross-site scripting XSS vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898...

CVE-2015-7728

Cross-site scripting XSS vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898...

CVE-2015-7728

CVE-2015-7728 is an XSS vulnerability in SAP HANA DB’s Web-based Development Workbench, specifically in user creation. The issue allows remote authenticated users to inject arbitrary web script or HTML via the username field in NewDB100_REL (SAP HANA DB 1.00.73.00.389160). The CVSSv2 vector (AV:N...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write

This module exploits a vulnerability that exists due to a lack of input validation when creating a user. Messages for a given user are stored in a directory partially defined by the username. By creating a user with a directory traversal payload as the username, commands can be written to a given...

Multiple Cross-Site Request Forgery Vulnerabilities in Ignite Realtime Openfire

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...

Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL Cross-Site Request Forgery Vulnerability

The Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL is a router product from Alcatel-Lucent, France. A cross-site request forgery vulnerability in the Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL using firmware version 1.0.0.20h.HOL allows remote attackers to construct malicious URIs, trick users...

Beckhoff IPC Diagnostics Arbitrary User Creation Vulnerability

Beckhoff IPC Diagnostics is a set of support software pre-installed in all Beckhoff IPCs/PLCs Programmable Logic Controllers running on the Microsoft Windows operating system. Beckhoff IPC Diagnostics fails to properly restrict access to functions in the /config URI, allowing a remote attacker to...

CVE-2015-4051

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service reboot or shutdown, create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a...