41 matches found
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322: Time-of-check Time-of-use (TOCTOU) Race Condition
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2022-42724
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
CVE-2022-42724: Incorrect Authorization
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
CVE-2022-42724
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
MISP 信息泄露漏洞
MISP is an open source software solution. It is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. information leakage vulnerability exists in versions of MISP prior to 2.4.164, which stems...
CVE-2022-29534: Improper Authentication
An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...
Input validation
Exponent CMS before 2.6.0 has improper input validation in usersController.php...
CVE-2016-9022
Exponent CMS before 2.6.0 has improper input validation in usersController.php...
CVE-2016-9022: Improper Input Validation
Exponent CMS before 2.6.0 has improper input validation in usersController.php...
CVE-2018-12649
CVE-2018-12649 affects MISP 2.4.92 in app/Controller/UsersController.php, where brute-force protection for login only covers POST requests. An adversary can bypass protection by using PUT for login, enabling potential brute-force attempts. The recorded metrics show CVSS v3 base score 9.8 (CRITICA...
CVE-2018-12649: Improper Restriction of Excessive Authentication Attempts
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests...
CVE-2017-16946: Insertion of Sensitive Information into Log File
The adminedit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enablepassword field, which allows admins to discover a hashed password by reading the audit log...
CVE-2016-9286
framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI...
CVE-2016-9284
getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string...
CVE-2016-9286
framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI...
CVE-2016-9286: Exposure of Sensitive Information to an Unauthorized Actor
framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI...