549 matches found
CVE-2024-11069 WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion
The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPressGDPRDataDelete::checkaction' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users...
WordPress WordPress GDPR plugin <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary User Deletion vulnerability discovered by István Márton in WordPress Plugin WordPress GDPR & CCPA versions = 2.0.2...
CVE-2024-45877
baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock...
CVE-2024-46892
A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing...
PT-2024-8718 · Siemens · Sinec Ins
Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 3 Description: A vulnerability has been identified in the affected application where it does not properly invalidate sessions when the associated user is deleted, disabled, or their permissions are...
PT-2024-39956 · WordPress · Multivendorx
Name of the Vulnerable Software and Affected Versions: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to, and including, 4.2.4 Description: The issue is due to missing or incorrect nonce validation on several functions in...
CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry
Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...
CVE-2024-2843 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks...
CVE-2024-2843 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks...
CVE-2024-37768
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...
CVE-2024-37768
CVE-2024-37768 affects 14Finger v1.1: an arbitrary user deletion vulnerability exists via the endpoint /api/admin/user?id. The CVE entry lists a CRITICAL impact (CVSS v3.1: 9.1) with network access, no user interaction, and no privileges required; impacts include high integrity and high availabil...
14Finger Security Vulnerability
14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in 14Finger version 1.1, which stems from an arbitrary user deletion vulnerability in component /api/admin/user?id...
Logic flaw vulnerability in KingH5Stream system of Beijing Asia Control Technology Development Co.
Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of industrial automation and informatization software platform. There is a logic flaw vulnerability in the KingH5Stream system of Beijing Asian Control Technology Development Co., Ltd. that can be exploited by an...
CVE-2024-35050
An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin...
PT-2024-23314 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: anything-llm affected versions not specified Description: The application is susceptible to a flaw due to improper input validation. An attacker can exploit this by sending a malformed JSON payload to the /system/enable-multi-user endpoint...
AnythingLLM 输入验证错误漏洞
AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an input validation error vulnerability that stems from allowing an attacker to delete all existing users and potentially create new administrator users without a password, leading to unauthorized access...
CVE-2024-20347
Cisco Emergency Responder is affected by a cross-site request forgery (CSRF) vulnerability in the web UI that, together with insufficient protections, could allow an unauthenticated or user-privileged actor to perform arbitrary actions on the device when a user visits a crafted link. The root cau...
Cross-Site Request Forgery in Anchor CMS
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery CSRF via /anchor/admin/users/delete/2...