2122 matches found
Authentication flaw
An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous us...
CVE-2021-43974
CVE-2021-43974 affects SysAid ITIL 20.4.74 b10. The /enduserreg endpoint allows anonymous users to register new accounts even when the server-side setting to disable anonymous registration is enabled, bypassing client-side controls and enabling account creation without authentication. Connected d...
Improper Authorization in Keycloak
A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled...
GlFusion Cms Arbitrary User Registration Vulnerability
glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to arbitrary user registration, which can be exploited by attackers to register using any user's email address...
CVE-2021-44937
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-44937
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-44937
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
Design/Logic Flaw
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-44937
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...
CVE-2021-44937
CVE-2021-44937 affects glFusion CMS v1.7.9. Descriptions across multiple sources state an arbitrary user registration vulnerability in /public_html/users.php, allowing attackers to register using any user’s mailbox and observe that the mailbox becomes occupied. The root cause is insufficient vali...
GlFusion Cms 授权问题漏洞
glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to arbitrary user registration, which can be exploited by attackers to register using any user's email address...
CVE-2021-24955
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the ppgetformsbybuildertype AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24954
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppressccdata parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24955
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the ppgetformsbybuildertype AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
Cross site scripting
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the ppgetformsbybuildertype AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
Cross site scripting
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppressccdata parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24955 ProfilePress < 3.2.3 - Reflected Cross-Site Scripting
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the ppgetformsbybuildertype AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-40282
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dldownload.php. when registering ordinary users...