2193 matches found
CVE-2021-36388
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4"...
Yellowfin Business Intelligence Yellowfin 安全漏洞
An insecure direct object reference vulnerability exists in versions of Yellowfin prior to 9.6.1, a business intelligence automated analytics, cross-vendor narrative and collaboration software suite. An attacker could exploit the vulnerability by sending a specially crafted HTTP GET request to th...
Yellowfin Cross Site Scripting / Insecure Direct Object Reference
YELLOWFIN 9.6.1 MULTIPLE VULNERABILITIES ---------------------------------------------------- Vulnerability: ============== Stored Cross-Site Scripting Affected Products and Versions: =============================== Yellowfin 9.6.1 CVEID: ====== CVE-2021-36387 CVSSv3.1 Score: =============== 5.4...
Siemens SINEC NMS User Profile Download Vulnerability
SINEC NMS is a network management system introduced by Siemens for monitoring and managing industrial networks.A user profile download vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. An attacker could exploit this vulnerability to download any user's user profile, which coul...
Siemens SINEC NMS User Profile Change Vulnerability
SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A user profile change vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. The vulnerability can be exploited by an attacker to change the user profile of any user without proper...
CVE-2021-33723
A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...
CVE-2021-33727
A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system...
CVE-2021-33727
A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system...
CVE-2021-33727
Summary: CVE-2021-33727 affects Siemens SINEC NMS prior to v1.0 SP2 Update 1. An authenticated attacker can download any user’s profile, enabling disclosure of confidential information. This is categorized as an information disclosure vulnerability (Exposure of Sensitive Information to an Unautho...
CVE-2021-33723
Siemens SINEC NMS before version 1.0 SP2 Update 1 contains a vulnerability (CVE-2021-33723) that allows an authenticated attacker to change the user profile of any user, including passwords, due to improper authorization. This affects all versions prior to 1.0 SP2 Update 1. The issue is documente...
PT-2021-20298 · Siemens · Sinec Nms
Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows an authenticated attacker to change the user profile of any user without proper authorization, potentially enabling them to change the...
Online Traffic Offense Management System 1.0 - Multiple RCE (Unauthenticated)
Exploit Title: Online Traffic Offense Management System 1.0 - Multiple RCE Unauthenticated Date: 07/10/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link:...
Online Traffic Offense Management System 1.0 - Multiple Remote Code Execution Vulnerability
Exploit Title: Online Traffic Offense Management System 1.0 - Multiple RCE Unauthenticated Exploit Author: Hubert Wojciechowski Contact Author: email protected Vendor Homepage: https://www.sourcecodester.com Software Link:...
PT-2021-23328 · Archibus · Archibus Web Central
Name of the Vulnerable Software and Affected Versions: ARCHIBUS Web Central version 21.3.3.815 Description: The issue arises from the software's failure to properly validate requests for access to data and functionality in several affected endpoints: "/archibus/schema/ab-edit-users.axvw",...
CVE-2021-37333
Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...
CVE-2021-41391
In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leading to session hijacking and full account takeover...
CVE-2021-41390
In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection...
CVE-2021-41390
In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection...
CVE-2021-41391
In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leading to session hijacking and full account takeover...
