32 matches found
hikvision_CVE-2017-7921_auth_bypass_config_decryptor
hikvisionCVE-2017-7921authbypassconfigdecryptor Этот python-файл расшифрует конфигурационный файл configurationFile, используемый камерами Hikvision, уязвимыми к CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Описание Обход аутентификации IP-камер...
CVE-2026-90495
Fengoffice Feng Office versions up to 3.11.13.11 contain a SQL injection vulnerability in the Legacy API component, specifically in the function Contacts::instance->findAll within the file application/models/CompanyWebsite.class.php. Manipulation of the auth argument allows a remote, unauthent...
CVE-2026-90495 Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...
EUVD-2026-55225
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gh9f-6xm2-c4j2. This link is maintained to preserve external references. Original Description SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE...
The vulnerability of the yiisoft/yii2-redis framework in Yii, which allows attackers to expose protected information.
The vulnerability of the yiisoft/yii2-redis framework in Yii is related to the exposure of information through registration files. Exploiting this vulnerability allows a malicious actor to disclose protected information through the AUTH parameter...
yii2-redis 日志信息泄露漏洞
yii2-redis is an extension to yii open source. A log information disclosure vulnerability exists in yii2-redis versions prior to 2.0.20, which stems from the explicit logging of the AUTH parameter in the logs, which could lead to credential disclosure...
moonmoon security breach
moonmoon is a web-based aggregator similar to Planetplanet. It can be used to mix posts from different blogs with the same interests into a single page. A security vulnerability exists in moonmoon, which stems from an incorrect comparison of the auth parameter on the admin/inc/auth.inc.php page...
CVE-2023-51049
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
PT-2022-12035
Name of the Vulnerable Software and Affected Versions GUnet Open eClass versions prior to 3.12.2 Description The issue allows for XSS via the auth parameter in the modules/auth/formuser.php file. Recommendations For versions prior to 3.12.2, update to version 3.12.2 or later to resolve the issue...
CVE-2021-44266: Improper Neutralization of Input During Web Page Generation
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
CVE-2019-10196
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...
CVE-2019-10196: Improper Initialization
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...
PT-2021-8866
Name of the Vulnerable Software and Affected Versions http-proxy-agent versions prior to 2.1.0 Description A flaw was found in http-proxy-agent where it passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all...
CentOS 8 : squid:4 (CESA-2019:3476)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3476 advisory. - squid: XSS via username or auth parameter in cachemgr.cgi CVE-2019-13345 Note that Nessus has not tested for this issue but has instead relied only on the...
PT-2020-6044
Name of the Vulnerable Software and Affected Versions Exim versions 4 through 4.94.1 Exim version 4.94.2 is not affected, so all versions prior to 4.94.2 are considered vulnerable. Description The issue is related to insufficient input validation in the Exim message relay agent. This can be...
