2193 matches found
CVE-2020-25476
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting XSS vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected...
CVE-2020-35737
In Correspondence Management System corms in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference...
Design/Logic Flaw
In Correspondence Management System corms in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference...
CVE-2020-35737
CVE-2020-35737 affects Newgen eGov 12.0, specifically the Correspondence Management System (corms). The vulnerability is an Insecure Direct Object Reference caused by an unvalidated UserIndex parameter in the personal settings page, allowing an attacker to modify other users’ profile information....
Victor CMS 1.0 Shell Upload
Exploit Title: Victor CMS 1.0 - File Upload To RCE Date: 20.12.2020 Exploit Author: Mosaaed Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested on: Apache2/Linux Step1: register...
CVE-2020-35273
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery CSRF to remotely gain privileges in the User Profile panel. An attacker can update any user's account...
CVE-2020-35273
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery CSRF to remotely gain privileges in the User Profile panel. An attacker can update any user's account...
Tangro Business Workflow Authorization Issues Vulnerability (CNVD-2020-74071)
Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A security vulnerability exists in Tangro Business Workflow versions prior to 1.18.1, which can be exploited by an attacker to...
CVE-2020-26175
In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users...
CVE-2020-26175
CVE-2020-26175 affects Tangro Business Workflow prior to 1.18.1. An attacker can manipulate the value of the PERSON parameter in requests to the /api/profile endpoint to change the profile information of other users. The root cause is an authorization/validation flaw that allows parameter tamperi...
CVE-2020-26177
CVE-2020-26177 affects Tangro Business Workflow prior to 1.18.1. The issue is an access control flaw: certain profile items are rendered as greyed out on the client, but the server does not enforce this restriction—manipulating greyed‑out values in requests to /api/profile is not prohibited serve...
CVE-2020-26177
In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...
CVE-2020-26408
A limited information disclosure vulnerability exists in Gitlab CE/EE from = 12.2 to =13.5 to =13.6 to 13.6.2 that allows an attacker to view limited information in user's private profile...
Information disclosure
A limited information disclosure vulnerability exists in Gitlab CE/EE from = 12.2 to =13.5 to =13.6 to 13.6.2 that allows an attacker to view limited information in user's private profile...
CVE-2020-26408
CVE-2020-26408 affects GitLab CE/EE versions: 12.2 to <13.4.7, 13.5 to <13.5.5, and 13.6 to
CVE-2020-26408
Removed by vendor...
Cross-Site Scripting (XSS)
moodle/moodle is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript via the moodlenetprofile user profile field...
Moodle 3.9.x < 3.9.2 XSS Vulnerability
Moodle is prone to a stored cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...