User enumeration setting not obeyed in User Status API

None...

PT-2022-11377 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.14 Nextcloud Server versions prior to 21.0.6 Nextcloud Server versions prior to 22.2.1 Description: The Nextcloud server is a self-hosted system designed to provide cloud-style services. In affected...

CVE-2021-41239: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It...

DRUPAL-CONTRIB-2021-047

This modules enables users to login via email address. This module does not sufficiently check user status when authenticating...

Mail Login - Moderately critical - Access bypass - SA-CONTRIB-2021-047

This modules enables users to login via email address. This module does not sufficiently check user status when authenticating...

UBUNTU-CVE-2020-35480

An issue was discovered in MediaWiki before 1.35.1. Missing users accounts that don't exist and hidden users accounts that have been explicitly hidden due to being abusive, or similar that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to...

CVE-2020-12472

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...

CVE-2020-12472

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...

Cross site scripting

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...

CVE-2020-12472

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...

PT-2020-13132

Name of the Vulnerable Software and Affected Versions MonoX versions 5.1.40.5152 and earlier Description The issue allows stored XSS via User Status, Blog Comments, or Blog Description. This can lead to malicious script execution when a user views the affected content. Recommendations For MonoX...

CVE-2020-12472: Improper Neutralization of Input During Web Page Generation

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description...

Unspecified vulnerability in Moodle (CNVD-2019-43886)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle versions 3.7 through 3.7.2 and 3.6 through 3.6.6, which stems from a failure of the Email med...

Moodle 3.6.x < 3.6.7, 3.7.x < 3.7.3 Multiple Vulnerabilities

Moodle is prone to a vulnerability where email media URLs were not checked for the user status. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2019-6796

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 2 of 2. The user status field contains a lack of input validation and output encoding that results in a persistent XSS...

CVE-2019-6796

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 2 of 2. The user status field contains a lack of input validation and output encoding that results in a persistent XSS...

CVE-2019-6796

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 2 of 2. The user status field contains a lack of input validation and output encoding that results in a persistent XSS...

CVE-2019-6796

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 2 of 2. The user status field contains a lack of input validation and output encoding that results in a persistent XSS...

CVE-2019-6796: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 2 of 2. The user status field contains a lack of input validation and output encoding that results in a persistent XSS...

PT-2019-18355

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x through 11.6.5, 11.7.x through 11.7.0 Description The issue allows for a persistent XSS due to a lack of input validation and output encoding in the user status field...