549 matches found
BIT-MOODLE-2022-0985
Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability...
Upgraded Q -> 3 from #518 [1699029907154]
Judge has assessed an item in Issue 518 as 3 risk. The relevant finding follows: L-01 StakedAt time is not deleted during the issuance of prime tokens When a directly revocable token is issued, the stakedAt time of the user is deleted delete stakedAtusersi. This is not done when an irrevocable...
CVE-2023-46249 authentik potential installation takeover when default admin user is deleted
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...
Registered OTP Device Removal Failure on native OTP management page
The following log can be found in "/tmp/aaad.debug" nsldapregisterencryptedotp 1-52: nsldapregisterencryptedotp: secret empty, nothing to delete for user...
Protect
An insufficient session expiration CWE-613 vulnerability in FortiOS REST API may allow an attacker to keep a secure websocket session active after user deletion...
CVE-2023-36256
The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is...
Stored XSS via user's Full Name
Description The user's full name is rendered as HTML during user deletion. This enables an user to add Javascript code in the username which when can be executed in admin's webpage during user deletion. Proof of Concept - Login as a normal user and change the Full name to: javascript "...
The user can delete himself
Description Bypassing the conditional check leads to the user can delete himself. Proof of Concept Step 1: The user with id 18834 attempts to delete himself but encounter an error Step 2: By using userid=18834' instead of userid=18834, the user was able to successfully delete himself...
IDOR in message deletion
Description user can delete others's message. we know the report https://huntr.dev/bounties/24ae402f-220f-41c6-962e-47c26938986e/ , but we find that we do not fix one case. Proof of Concept 1 user1 send admin a greeting card1 2 user2 send admin a greeting card2 3 user1 delete his message related ...
CVE-2023-32310 DataEase API interface has IDOR vulnerability
DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references IDOR. This could result in a user deleting another user's dashboard or messages or interfering with the...
Feather Login Page < 1.1.2 - Missing Authorization to Non-Arbitrary User Deletion
The plugin does not check authorization when processing the ftlpp-ext-expirable-delete-user ajax action, which could allow users with roles as low as subscriber to delete temporary users generated by the plugin, furthermore it does not protect the action against CSRF attacks, allowing an...
Feather Login Page < 1.1.2 - Missing Authorization to Non-Arbitrary User Deletion
The plugin does not check authorization when processing the ftlpp-ext-expirable-delete-user ajax action, which could allow users with roles as low as subscriber to delete temporary users generated by the plugin, furthermore it does not protect the action against CSRF attacks, allowing an...
Session Fixation
org.apache.inlong is vulnerable to Session Fixation. The vulnerability exists due to insufficient session expiration, which allows an attacker to use old sessions even after the user has been deleted or the password has been changed...
PT-2023-19516 · Thorsten · Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.13 Description: The issue is related to improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, phpMyFAQ does not properly validate email addresses when updating user profiles,...
The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to remove arbitrary users.
The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController function. Exploiting this vulnerability could allow a malicious actor to delete arbitrary users remotely...
Insufficient Session Expiration
Description User session are still vaild when users is deleted or password is changed Proof of Concept 1 user1 login in browser1 2 admin delete user1 in browser2 3 user1 can still do anyting...
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass Exploit
Exploit Title: Zoneminder v1.36.26 - Log Injection - CSRF Bypass - Stored Cross-Site Scripting XSS Exploit Author: Trenches of IT Vendor Homepage: https://github.com/ZoneMinder/zoneminder Version: v1.36.26 Tested on: Linux/Windows CVE: CVE-2022-39285, CVE-2022-39290, CVE-2022-39291 Writeup:...
Cross site request forgery (csrf)
The WP OAuth Server OAuth Authentication WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client...
SUSE CVE-2013-2059
OpenStack Identity Keystone Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token...