52 matches found
PT-2025-50524
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify...
EUVD-2020-22921
Malware in sbrugna...
EUVD-2020-22920
Malware in sbrugna...
EUVD-2020-22923
Malware in sbrugna...
EUVD-2020-22922
Malware in sbrugna...
š MikroTik RouterOS Cross Site Scripting
A reflected cross site scripting vulnerability exists in MikroTik RouterOS versions prior to version 7, specifically in the UserManager web interface. This flaw can be exploited by unauthenticated attackers, allowing JavaScript injection via a specially crafted URL without requiring a valid login...
CVE-2020-35245
Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser...
CVE-2020-35242
Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory...
CVE-2020-35244
Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup...
CVE-2020-35243
Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb...
ABB Cylon Aspect 3.08.01 jsonProxy.php Username Enumeration Vulnerability
ABB Cylon Aspect version 3.08.01 is vulnerable to username enumeration in the jsonProxy.php endpoint. An unauthenticated attacker can interact with the UserManager servlet to enumerate valid usernames on the system. Since jsonProxy.php proxies requests to internal services without requiring...
ABB Cylon Aspect 3.08.01 jsonProxy.php Username Enumeration
ABB Cylon Aspect 3.08.01 jsonProxy.php Username Enumeration Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy management and...
Issues identified on devices running Android 14 that impact restrictions set by SecureHub.
On Android 14, some admin-set UserManager restrictions may be permanently applied on reboot, preventing SecureHub from effectively un-setting those restrictions. Affected settings are in Appendix A 2. On the upgrade from Android 13 to Android 14, some admin-set UserManager restrictions may be...
ASB-A-217981062
In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...
CVE-2021-44076
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting XSS. The payload can be executed in multiple scenarios, for example when the user'...
CVE-2021-44076
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting XSS. The payload can be executed in multiple scenarios, for example when the user'...
CVE-2021-42943
Stored cross-site scripting XSS in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter...
Cross site scripting
Stored cross-site scripting XSS in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter...
IPPlan č·Øē«čę¬ę¼ę“
IPPlan is a web-based multilingual TCP IP address management IPAM software and tracking tool. Simplifying the management of the IP address space, IPPlan version 4.92b is vulnerable to a cross-site scripting vulnerability, which stems from a cross-site scripting XSS vulnerability found in...
Open Redirect
microweber is vulnerable to open redirect. An attacker is able to avert a user to a malicious website via an extra slash '/' through the logout function in the UserManager...