Improper access control

A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2023-2979 Abstrium Pydio Cells User Creation access control

A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

PT-2023-22421 · Abstrium · Abstrium Pydio Cells

Name of the Vulnerable Software and Affected Versions: Abstrium Pydio Cells version 4.2.0 Description: A critical vulnerability was found in the User Creation Handler component, leading to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 i...

PT-2023-22418 · Abstrium · Abstrium Pydio Cells

Name of the Vulnerable Software and Affected Versions: Abstrium Pydio Cells version 4.2.0 Description: A critical issue has been found in the User Creation Handler component, leading to improper access controls. The attack can be initiated remotely. Upgrading to version 4.2.1 addresses this issue...

USN-6106-1: calamares-settings-ubuntu vulnerability

It was discovered that calamares-settings-ubuntu allowed creating the first user with a blank password, contrary to expectations...

Design/Logic Flaw

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise...

CVE-2023-1698

CVE-2023-1698 refers to a remote, unauthenticated command-execution vulnerability in multiple WAGO products that use Web-based management. The issue permits an attacker to create new users and alter device configuration, potentially resulting in unintended behavior, Denial of Service, and full sy...

EnterpriseDB EDB Postgres Advanced Server 安全漏洞

EnterpriseDB EDB Postgres Advanced Server is the core database product for EDB from EnterpriseDB, Inc. A security vulnerability exists in EnterpriseDB EDB Postgres Advanced Server EPAS versions prior to 14.6.0, which stems from an unedited password being logged when the optional parameter is used...

xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro

Impact If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. To reproduce: On a wiki with view rights for guests but user registration disabled, open as guest...

GHSA-FP36-MJW5-FMGX xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro

Impact If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. To reproduce: On a wiki with view rights for guests but user registration disabled, open as guest...

CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...

CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...

CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...

Code injection

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

CVE-2022-45178

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A...

CVE-2022-45178

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A...

PT-2023-14631 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: An issue exists in the software due to Broken Access Control. This issue affects several API endpoints: "/api/v1/vdeskintegration/saml/user/createorupdate",...

Weak Password Requirements

phpmyfaq has Weak Password Requirements. A remote attacker is able to easily compromise user accounts because weak passwords are associated with the accounts due to the enforcement of a weak password policy while creating a new user with the admin account...

The vulnerability in the web interface of the Aruba Networks ClearPass Policy Manager allows a malicious actor to create arbitrary users on the platform and increase their privileges.

The vulnerability of the web-based interface of the Aruba Networks ClearPass Policy Manager is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to create arbitrary users on the platform and increase their privileges...

Users who joined later can see the data of deleted users

Proof of Concept 1 admin create a user, named as user1 2 user1 login and create Inlong Group 3 admin delete user1 4 admin create aonther user, whose name is also user1 5 user1 login and can see the Inlong Group created by old user1...