1332 matches found
CVE-2021-41325
Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. In addition, such users can be granted several admin permissions via the Roles parameter...
Backdrop CMS 1.20.0 Cross Site Request Forgery / Command Execution
Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery CSRF Exploit Author: V1n1v131r4 Date: 2021-09-22 Vendor Homepage: https://backdropcms.org/ Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip Version: 1.20.0 Tested On: Kali Linux,...
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in tildeclub/site
āļø Description The file signup-handler.php creates a user by accepting input from request parameters username, email, interest, sshkey. The affected parameter is sshkey. It does not sanitizes special characters and only checks if the first 4 character of the input is ssh- which allows the signup...
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
āļø Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Create users with PoC.html šµļøāāļø Proof of Concept 1. User with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after visiting...
CVE-2021-38617
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation...
CVE-2021-38617
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation...
Privilege escalation
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation...
CVE-2021-38617
Eigen NLP 3.10.1 is affected. The issue stems from a lack of access control on the /auth/v1/user/ endpoint, allowing a standard user to create a superuser with a defined password, enabling privilege escalation. The CVSS data in the linked records indicates a high-severity impact (CVSS 3.1 base sc...
CVE-2021-38617
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation...
CVE-2021-33831
api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 random users within 2500 seconds...
CVE-2021-33831
api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 random users within 2500 seconds...
TH Wildau COVID-19 Contact Tracing ęęé®é¢ę¼ę“
TH Wildau COVID-19 Contact Tracing is a web application used for contact tracing in the event of a SARS Cov2 infection. An authorization issue vulnerability exists in TH Wildau COVID-19 Contact Tracing that stems from the product's registration API not validating input. An attacker could use this...
Eigen NLP å®å Øę¼ę“
Eigen NLP is a natural language processing system. A security vulnerability exists in Eigen NLP 3.10.1 that stems from a lack of access control on the /auth/v1/user/ user creation endpoint. The vulnerability allows a standard user to create a superuser account with a defined password, which...
Tecknodreams SapphireIMS Insecure Direct Object Reference Vulnerability
Tecknodreams SapphireIMS is an ITIL 2011 certified enterprise class service management system from Tecknodreams India. A security vulnerability exists in Tecknodreams SapphireIMS 40971. The vulnerability stems from an insecure direct object reference in the local user creation function. An attack...
Cross-Site Request Forgery (CSRF) in aces/loris
āļø Description Attacker able to create admin user with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks...
CVE-2017-16630
In SapphireIMS 40971, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object Reference IDOR in the local user creation function...
CVE-2017-16630
In SapphireIMS 40971, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object Reference IDOR in the local user creation function...
CVE-2020-21358
A cross site request forgery CSRF in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users...
