Snipe-IT version 8.0.4 and below has an IDOR vulnerability in the `/locations/<id>/printassigned` endpoint. This allows an authenticated user to access asset assignment data of other departments by changing the `location_id` in the URL.
The Daikin Security Gateway 214 is vulnerable to an IDOR flaw in its password reset API endpoint. An attacker can exploit this vulnerability by sending a crafted POST request, bypassing authentication mechanisms. Successful exploitation results in resetting the system credentials to the default Daikin:Daikin username and password combination, granting unauthorized access to the system and potentially compromising connected devices and networks.
A stored XSS vulnerability in Nagios Log Server 2024R1.3.1 allows a low-privileged user to inject malicious JavaScript into the 'email' field of their profile. When an administrator views the audit logs, the script executes, resulting in privilege escalation via unauthorized admin account creation. The vulnerability can be chained to achieve remote code execution (RCE) in certain configurations.
The vulnerability exists in GeoVision GV-ASManager web application version 6.1.0.0 or below. An attacker with network access and a low privilege account can perform unauthorized actions like enabling/disabling accounts, creating new accounts, modifying privileges, and accessing resources. After privilege escalation, the attacker can access monitoring cameras, employee information, change configurations, disrupt services, clone access control data, and retrieve cleartext passwords for further attacks.
An Insecure Direct Object Reference (IDOR) vulnerability was found in UJCMS version 9.6.3, enabling unauthorized username enumeration through manipulation of the user id parameter in the /users/id endpoint. Despite user IDs being mostly large numbers, attackers can still discover existing account usernames without authentication, except for admin and anonymous accounts.
The vulnerability of Broken Access Control allows unauthorized users to access the home page and perform operations like creating, updating, or deleting trackers without the need for credentials.
A broken access control vulnerability was found in NodeBB v3.6.7, allowing unauthorized users to access restricted information meant for administrators only. By manipulating certain attributes in the JSON response after intercepting the group request, users with minimal privileges can access tabs limited to administrators. This issue was acknowledged and fixed by the developers upon discovery.
The SureMDM On-premise version 6.31 and below allows an attacker to bypass CAPTCHA and enumerate users. By sending requests to the /ForgotPassword.aspx/ForgetPasswordRequest endpoint with a User ID, an attacker can check if the User ID exists without being blocked by the CAPTCHA mechanism. This vulnerability has been assigned the CVE-2023-3897.
The vulnerability in Moodle version 4.3 allows an authenticated user to access different user details, email addresses, country, city/town, city, and timezone by manipulating the 'id' parameter in URLs like profile.php?id=11. By changing the 'id' value to another number, the attacker can view information of other users on the platform.
The SureMDM On-premise version 6.31 and below allows attackers to bypass CAPTCHA protection by enumerating valid user IDs, potentially leading to unauthorized access. This vulnerability has been assigned CVE-2023-3897.
Services By CQR