11798 matches found
PT-2023-2946 · Unknown · Expo Framework
Name of the Vulnerable Software and Affected Versions: Expo framework affected versions not specified Description: The issue is related to the implementation of the OAuth standard in the Expo framework, specifically with insufficient protection of registration data. An attacker can exploit this t...
UBUNTU-CVE-2023-29552
The Service Location Protocol SLP, RFC 2608 allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor...
CVE-2023-2243
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection...
Complaint Management System SQL注入漏洞
Complaint Management System is a complaint management system. A SQL injection vulnerability exists in Complaint Management System version 1.0, which stems from a problem in the file users/registration.php, where manipulation of the parameter fullname can lead to sql injection. No details of the...
PT-2023-18493 · Sourcecodester · Sourcecodester Complaint Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Complaint Management System version 1.0 Description: A critical issue was found in the SourceCodester Complaint Management System, affecting some unknown functionality of the file users/registration.php of the component POST...
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
Impact If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. To reproduce: On a wiki with view rights for guests but user registration disabled, open as guest...
GHSA-FP36-MJW5-FMGX xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
Impact If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. To reproduce: On a wiki with view rights for guests but user registration disabled, open as guest...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
Input validation
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...
CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...
Mars: ████ ' can change any account email and cannot retrieve his account and access it ' at ███
The security vulnerability described a method to change the email address of any user account, preventing the original user from accessing their account. The vulnerability involved manipulating the user profile update functionality to modify the email address. Despite an error message when...
Cross site request forgery (csrf)
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, suc...
Sql injection
Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php...
Yoga Class Registration System SQL注入漏洞
Yoga Class Registration System is a yoga class registration system. A SQL injection vulnerability exists in Yoga Class Registration System v1.0, which originates from the lack of validation of the cid parameter in /admin/login.php against external SQL input. An attacker can exploit this...
CVE-2023-29626
Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php...
WordPress WP Roles at Registration Plugin <= 0.23 is vulnerable to Cross Site Scripting (XSS)
Software WP Roles at Registration Type Plugin Vulnerable versions = 0.23 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27609 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8c0ad520c36f Credits Pavak Tiwari...
CVE-2023-29626
Yoga Class Registration System 1.0 has a SQL injection vulnerability in /admin/login.php via the cid parameter. Root cause is lack of validation/external SQL input, leading to potential unauthorized access to sensitive data. The CVSSv3.1 scores indicate high impact on confidentiality with no easy...