1196 matches found
VulnCheck KEV: CVE-2012-0262
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter...
CVE-2020-25762
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file adminclass.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract...
CVE-2020-25253
An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by the TableName, ColumnName, Name, UserId, or Password parameter...
Hyland OnBase SQL Injection Vulnerability (CNVD-2020-52045)
Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker to conduct a SQL injection attack via the TableName, ColumnName, Name, UserId, or Passwor...
PT-2020-14158
Name of the Vulnerable Software and Affected Versions DIGITUS DA-70254 4-Port Gigabit Network Hub version 2.073.000.E0008 Description The issue allows an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter. Recommendations For...
CVE-2020-15059: Improper Authentication
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter...
DEBIAN-CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldapattr and ldapentry community modules are used. The issue...
Advantech WebAccess/NMS Login SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the Login.view endpoint. When parsing the...
Security feature bypass
A security restriction bypass vulnerability has been discovered in Revive Adserver version 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was howev...
CVE-2020-10820
Nagios XI 5.6.11 allows XSS via the includes/components/ldapadintegration/ password parameter...
CVE-2020-10820
Nagios XI 5.6.11 allows XSS via the includes/components/ldapadintegration/ password parameter...
CVE-2020-10820: Improper Neutralization of Input During Web Page Generation
Nagios XI 5.6.11 allows XSS via the includes/components/ldapadintegration/ password parameter...
PT-2020-12344
Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.11 Description The issue allows for XSS via the password parameter in the includes/components/ldap ad integration/ endpoint. Recommendations For Nagios XI version 5.6.11, avoid using the password parameter in the...
Ignite Realtime Openfire Cross-Site Scripting Vulnerability
Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.4.1. An attacker can exploit this vulnerability via the setup/setup-datasource-standard.jsp password parameter ...
CVE-2019-20526
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...
Design/Logic Flaw
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...
CVE-2019-20526
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...
CVE-2019-20526: Improper Neutralization of Input During Web Page Generation
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...
PT-2019-6264
Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.5 Description The issue is related to the failure to neutralize special elements in user-input strings during password parameter syntax analysis in the Administrative Console Framework...