CVE-2018-1000193

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

CVE-2018-11127

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

Cross site request forgery (csrf)

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

CVE-2018-11127 pertains to the e107 CMS, targetting version 2.1.7. The issue is a Cross-Site Request Forgery (CSRF) that allows arbitrary user deletion. Root cause and impact are documented across multiple sources (including Red Hat and CNVD). According to CVSS, the vulnerability is network-expos...

CVE-2016-8629

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

Design/Logic Flaw

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

CVE-2016-8629

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

CVE-2016-8629

CVE-2016-8629 affects Red Hat Keycloak prior to version 2.4.0. The vulnerability is a failure to properly enforce permissions when handling service account user deletion requests sent to the REST server. An attacker with service account authentication could bypass normal permissions and delete us...

CVE-2017-15052

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...

CVE-2017-1000142

The CVE affects Mahara releases prior to 1.8.7, 1.9.5, 1.10.3 and 15.04.0 (i.e., Mahara 1.8, 1.9, 1.10 series and 15.04) where users could delete their submitted pages via URL manipulation. The root cause is not explicitly detailed in the provided documents beyond this behavior. The references co...

Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in the administration user deletion resource ...

CVE-2017-14587

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the uname parameter...

CVE-2017-14587

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the uname parameter...

CVE-2017-14587

Summary: CVE-2017-14587 affects Atlassian Fisheye and Crucible prior to 4.4.2. An administration user deletion resource is vulnerable to a cross-site scripting (XSS) flaw in the uname parameter, enabling a remote attacker to inject arbitrary HTML or JavaScript. The issue is exploitable remotely o...

zzcms /user/del. php injection vulnerability

No description provided by source...

Design/Logic Flaw

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...