PYSEC-2021-91

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicio...

CVE-2020-25762

An issue was discovered in SourceCodester Seat Reservation System 1.0. The file adminclass.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract...

DRUPAL-CONTRIB-2020-021

This module enables you to force a password update when using password reset link. The module doesn't sufficiently validate the login URL allowing a malicious user to use a specially crafted URL to log in as another user...

PT-2020-6641 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.11.6 GitLab versions prior to 13.12.6 GitLab versions prior to 14.0.2 Description: The issue is related to a reflected cross-site script vulnerability. It allows a remote attacker to compromise data integrity by...

PT-2019-15790 · Napc Xinet · Napc Xinet Elegant 6 Asset Library

Name of the Vulnerable Software and Affected Versions: NAPC Xinet Elegant 6 Asset Library version 6.1.655 Description: The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the username field in the LoginForm when double quotes are used...

PYSEC-2019-174

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/...

Sensitive Data Exposure

Overview Versions of loopback prior to 3.26.0 3.x and 2.42.0 2.x are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft. Recommendation If you'...

PT-2019-1633 · Openwsman +5 · Openwsman +5

Name of the Vulnerable Software and Affected Versions: Openwsman versions up to and including 2.6.9 Description: The issue is related to an infinite loop in the process connection function when parsing specially crafted HTTP requests, such as /api/v1/login. A remote, unauthenticated attacker can...

CVE-2018-19548

index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginFormusername and LoginFormpassword parameters, which might make it easier for remote attackers to obtain access via a brute-force approach...

CVE-2018-19468

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

PT-2018-3880 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to a stack-based buffer overflow that can occur when a very long password is sent to the /goform/formLogin endpoint. This can lead to overwriting the return address. The...

PT-2018-1375 · Canon · Canon Lbp3370 +3

Name of the Vulnerable Software and Affected Versions: Canon LBP6650 versions Canon LBP3370 versions Canon LBP3460 versions Canon LBP7750C versions Description: The issue is related to a weakness in the authentication procedure of Canon printer software when using standard device settings. It...

CVE-2017-18262

Blackboard Learn Since at least 17th of October 2017 has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI...

Open-AudIT Professional Open Redirect Vulnerability

Open-AudIT Professional is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports. A security vulnerability exists in Open-AudIT Professional version 2.1. An attacker can exploit the vulnerability by sending the...

PT-2017-14035 · E Sic · E-Sic

Name of the Vulnerable Software and Affected Versions: E-Sic version 1.0 Description: An authentication bypass issue exists due to the acceptance of '=' or ' values for the username and password variables in the "/index" also known as "login" API endpoint. Recommendations: For E-Sic version 1.0, ...

CVE-2017-14615

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...

Opsview Monitor Pro Open Redirect Vulnerability

Opsview Monitor Pro is a suite of enterprise-class network, server and application monitoring tools from Opsview UK. The tool can be integrated with monitoring systems such as Nagios Core, RRDTool and others. An open redirection vulnerability exists in Opsview Monitor Pro. A remote attacker can...

WatchGuard Fireware XML-RPC User Enumeration Vulnerability

The full name of XML-RPC is XML Remote Procedure Call, that is, XML a subset under Standard Generalized Markup Language remote procedure call. A user enumeration vulnerability exists in WatchGuard Fireware XML-RPC, where when a login attempt is made using a blank password directly on the login...

PT-2016-6637

Name of the Vulnerable Software and Affected Versions D-Link DIR-850L B1 versions prior to 2.07WWB05 D-Link DIR-817 Ax affected versions not specified D-Link DIR-818LW Bx versions prior to 2.05b03beta03 D-Link DIR-822 C1 versions prior to 3.01WWb02 D-Link DIR-823 A1 versions prior to 1.00WWb05...