Cross site scripting

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process...

CVE-2022-48343

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process...

CVE-2022-48343

JetBrains TeamCity versions prior to 2022.10.2 are affected by CVE-2022-48343 due to an XSS vulnerability in the user creation process. The issue is documented across multiple sources (NVD entry for CVE-2022-48343, RH advisory, PT Security report) with a mitigation path recommending upgrading to ...

CVE-2022-48343

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process...

PT-2023-1864 · Moxa · Moxa Uc Series

Name of the Vulnerable Software and Affected Versions: Moxa UC Series devices affected versions not specified Description: The issue allows an attacker with physical access to the device to initiate a restart, gain access to the BIOS, and alter command line options to access the terminal. From th...

JetBrains TeamCity 跨站脚本漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...

PT-2023-15719 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2022.10.2 Description: The issue is related to an XSS vulnerability in the user creation process. Recommendations: For versions prior to 2022.10.2, update to version 2022.10.2 or later to resolve the issue...

Privilege Escalation

shenyu-admin is vulnerable to Privilege Escalation. The vulnerability is due to the library allowing low-privilege low-level administrators to create users with higher privileges than their own...

CVE-2023-22804

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

Authentication flaw

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

CVE-2023-22804 CVE-2023-22804

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

SUSE CVE-2010-1616

Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability...

SUSE CVE-2011-1835

The encrypted private-directory setup process in utils/ecryptfs-setup-private in ecryptfs-utils before 90 does not properly ensure that the passphrase file is created, which might allow local users to bypass intended access restrictions at a certain time in the new-user creation steps...

SUSE CVE-2011-2204

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

SUSE CVE-2019-15624

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...

CVE-2022-47132

A Cross-Site Request Forgery CSRF in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users...

CVE-2023-24830 Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3...

CVE-2023-24065

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...

rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

CVE-2022-46145

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...