246 matches found
CVE-2023-31719: Improper Neutralization of Special Elements used in an SQL Command
FUXA = 1.1.12 is vulnerable to SQL Injection via /api/signin...
CVE-2023-31719
FUXA = 1.1.12 is vulnerable to SQL Injection via /api/signin...
CVE-2023-31719
FUXA = 1.1.12 is vulnerable to SQL Injection via /api/signin...
PT-2023-23432
Name of the Vulnerable Software and Affected Versions FUXA versions 1.1.12 and earlier Description The issue is related to SQL Injection via the "/api/signin" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of potentially affected device...
Webkul Qloapps 1.5.2 - Cross-Site Scripting Vulnerability
Exploit Title: Webkul Qloapps 1.5.2 - Cross-Site Scripting XSS Exploit Author: Astik Rawat ahrixia Vendor Homepage: https://qloapps.com/ Software Link: https://github.com/webkul/hotelcommerce Version: 1.5.2 Tested on: Kali Linux 2022.4 CVE : CVE-2023-30256 Description: A Cross Site Scripting XSS...
SUSE CVE-2013-6634
The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...
SUSE CVE-2013-6643
The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/oneclicksigninbubbleview.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handli...
CVE-2022-24188
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct...
CVE-2022-24188
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct...
Shenzhen Fujia Technology OurPhoto 安全漏洞
Shenzhen Fujia Technology OurPhoto is a cloud photo frame software from Shenzhen Fujia Technology, China. It allows you to share photos and video files directly on your cell phone. A security vulnerability exists in Shenzhen Fujia Technology OurPhoto version 1.4.1, which originates from its...
CVE-2022-3058
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction...
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...
CVE-2022-30628
It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL...
CVE-2022-31127
NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail "signin endpoint" https://next-auth.js.org/getting-started/rest-apipost-apiauthsigninprovider that contains some malicious HTML, tricking the e-mail serve...
PT-2022-20548
Name of the Vulnerable Software and Affected Versions NextAuth.js versions prior to 3.29.8 NextAuth.js versions prior to 4.9.0 Description An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, s...
CVE-2022-31127: Improper Neutralization of Input During Web Page Generation
NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...
Malicious code in pseudo-loc-for-signin-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d100c05109c3b4d84fa03d2463e93fb0b235b5e8f13d497016d190fdbcfc1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5506 Malicious code in pseudo-loc-for-signin-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d100c05109c3b4d84fa03d2463e93fb0b235b5e8f13d497016d190fdbcfc1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in courage-for-signin-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651ba90b6cbf4d05699e79773d63de9bb241b1d23330c1d88b9c2032e8bd52ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2215 Malicious code in courage-for-signin-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651ba90b6cbf4d05699e79773d63de9bb241b1d23330c1d88b9c2032e8bd52ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...