541 matches found
CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros th...
U.S. Dept Of Defense: IDOR to delete profile images in https:███████
A vulnerability was discovered in which profile images could be deleted through a GET request by supplying a user ID. This allowed unauthorized deletion of user profile images...
Design/Logic Flaw
Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when hideuserprofilesfrompublic is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no know...
Discourse Information Disclosure Vulnerability
Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from an information disclosure vulnerability that originates from allowing unauthorized attackers to access user profiles via hideuserprofilesfrompublic...
Locally cached profiles not getting deleted at User logoff from the VDA
Locally cached user profiles does not get deleted at user logoff. User gets a temp profile at next consecutive login...
HOW TO | New network printers are not saving after re-logon
• The users are able to connect and add their network printers to their VDI sessions. However, after logoff the printer settings are not being retained within the user profile. • We would like to retain the network printer within the profile so that it is available for all subsequent logins...
WordPress Bulk Edit and Create User Profiles – WP Sheet Editor Plugin < 1.5.26 is vulnerable to Cross Site Scripting (XSS)
Software Bulk Edit and Create User Profiles – WP Sheet Editor Type Plugin Vulnerable versions 1.5.26 Fixed in 1.5.26 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8d00b38962a5...
CloudExplorer Lite 安全漏洞
CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box basic functionality for cloud hosting management, cloud billing, operational analytics, and security compliance, as well as powerful extensibility to meet the customization needs of enterprises. A security vulnerability...
PT-2023-18893 · Garmin · Ciq Api +1
Name of the Vulnerable Software and Affected Versions: GarminOS TVM component in CIQ API versions 1.0.0 through 4.1.7 Description: The permission system implemented by the GarminOS TVM component can be bypassed entirely, allowing a malicious application with specially crafted code and data sectio...
CVE-2023-31434
The parameters nutzertitel, nutzervn, and nutzernn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations...
GHSA-R69V-Q48G-3966 phpMyFAQ Improper Access Control vulnerability
phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to...
phpMyFAQ Improper Access Control vulnerability
phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to...
XWiki Platform vulnerable to code injection in display method used in user profiles
Impact Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The following syntax, to be put, e.g., in the about section of the user...
CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...
CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...
CVE-2022-38971
Stored Cross-Site Scripting XSS vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin = 2.7.5 versions...
CVE-2022-38971
Stored Cross-Site Scripting XSS vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin = 2.7.5 versions...
Cross site scripting
Stored Cross-Site Scripting XSS vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin = 2.7.5 versions...
CVE-2022-38971 WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-Site Scripting XSS vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin = 2.7.5 versions...
