PT-2020-5378

Name of the Vulnerable Software and Affected Versions Mk-Auth version 19.01 Description The issue is related to a lack of protection against SQL structure manipulation in the central/executar login.php component of the Mk-Auth authentication software. This allows a remote attacker to execute...

PT-2020-5380

Name of the Vulnerable Software and Affected Versions MK-AUTH version 19.01 Description The issue concerns an authentication bypass in the web login functionality. This is due to guessable credentials for the admin access to the admin/executar login.php endpoint. The vulnerability is related to...

CVE-2020-14973: Improper Neutralization of Input During Web Page Generation

The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting XSS vulnerability via the query string...

PT-2020-14099

Name of the Vulnerable Software and Affected Versions webTareas version 2.0p8 Description The issue concerns a Reflected Cross Site Scripting XSS vulnerability. This occurs via the query string in the loginForm within the general/login.php webpage. Recommendations For webTareas version 2.0p8,...

CVE-2020-12273

In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials...

CVE-2020-12273

In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials...

CVE-2020-12273: Missing Encryption of Sensitive Data

In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials...

PT-2020-13086

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.20 Description A crafted viewer parameter in the login.php endpoint exposes cleartext credentials. Recommendations For TestLink version 1.9.20, avoid using the viewer parameter in the login.php endpoint until the issue is...

CVE-2020-11545: Improper Neutralization of Special Elements used in an SQL Command

Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters account.php, uname and pass parameters login.php, and id parameter bookcar.php This allows an attacker to dump the MySQL database and to bypass the login...

PT-2020-6797

Name of the Vulnerable Software and Affected Versions Project Worlds Official Car Rental System 1 Description The issue is related to multiple SQL injection problems. Specifically, it affects the email and parameters in account.php, uname and pass parameters in login.php, and the id parameter in...

CVE-2019-19484

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

CVE-2019-19484

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

CVE-2019-19484

CVE-2019-19484 affects Centreon prior to version 19.04.5 (19.04.4 and below) and is due to an open redirect in login.php via the p URL parameter. An attacker can craft a payload to trigger unintended behavior by redirecting to an arbitrary URL. The linked records (including Red Hat advisory refer...

PT-2020-10168

Name of the Vulnerable Software and Affected Versions Centreon versions 19.04.4 and below Description The issue allows an attacker to craft a payload and execute unintended behavior via an open redirect in the login.php file. Additionally, command injection is possible via a plugin test in the...

CVE-2019-19484: URL Redirection to Untrusted Site

Open redirect via parameter ‘p’ in login.php in Centreon 19.04.4 and below allows an attacker to craft a payload and execute unintended behavior...

Centreon Input Validation Error Vulnerability (CNVD-2020-21242)

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . An input validation error vulnerability exists in Centreon 19.04.4 and earlier version...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-failed-login.php by adding a question mark ? followed by the payload...

CVE-2020-10447: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-failed-login.php by adding a question mark ? followed by the payload...

Cross site scripting

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

CVE-2020-6850

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...