CVE-2021-41825: Improper Neutralization of Input During Web Page Generation

Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...

CVE-2021-25499

Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store...

CVE-2021-25499

Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store...

Samsung Galaxy Store authorization issue vulnerabilities

Samsung Mobile Samsung Galaxy Store is an application store of Samsung Mobile, a South Korean company. A security vulnerability in SamsungAccountSDKSigninActivity in Samsung Galaxy Store versions prior to 4.5.32.4 allows an attacker to exploit the vulnerability to access the Galaxy Store's conten...

CVE-2021-32641

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

Design/Logic Flaw

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

CVE-2021-32641

CVE-2021-32641 affects Auth0-lock (Auth0’s signin solution). Versions up to and including 11.30.0 are vulnerable to a reflected XSS when user input from URL parameters is injected into the library’s flashMessage or languageDictionary features. The issue is addressed in version 11.30.1, which patc...

org.webjars.npm:okta__okta-signin-widget (2.21.0) potentially affected by CVE-2021-23369 via org.webjars.npm:handlebars (4.0.14)

org.webjars.npm:handlebars MAVEN version 4.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:handlebars and may be impacted: - org.webjars.npm:oktaokta-signin-widget 2.21.0 Source cves: CVE-2021-23369 Source advisory:...

org.webjars.npm:okta__okta-signin-widget (2.21.0) potentially affected by CVE-2021-23369 via org.webjars.npm:handlebars (4.0.14)

org.webjars.npm:handlebars MAVEN version 4.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:handlebars and may be impacted: - org.webjars.npm:oktaokta-signin-widget 2.21.0 Source cves: CVE-2021-23369 Source advisory:...

org.webjars.npm:directory-encoder (0.7.2), org.webjars.npm:okta__okta-signin-widget (2.21.0) potentially affected by CVE-2021-23369 via org.webjars.npm:handlebars (>=1.3.0, <=4.0.14)

org.webjars.npm:handlebars MAVEN version =1.3.0, =4.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:handlebars and may be impacted: - org.webjars.npm:directory-encoder 0.7.2 - org.webjars.npm:oktaokta-signin-widget 2.21.0 Source...

CVE-2020-21179

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page...

Sql injection

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page...

CVE-2020-21179

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page...

PT-2021-10601

Name of the Vulnerable Software and Affected Versions: koa2-blog version 1.0.0 Description: The issue allows remote attackers to inject malicious SQL statements via the name parameter to the signin page. This can be exploited by injecting a malicious SQL statement, potentially leading to...

CVE-2020-21179: Improper Neutralization of Special Elements used in an SQL Command

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page...

CVE-2019-12784

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

CVE-2019-12783

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...

CVE-2019-12783: URL Redirection to Untrusted Site

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...

CVE-2019-12784: Cross-Site Request Forgery (CSRF)

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

PT-2020-9340

Name of the Vulnerable Software and Affected Versions: Verint Impact 360 version 15.1 Description: An issue was discovered that allows attackers to potentially compromise valid credentials. At the /wfo/control/signin API endpoint, the rd parameter can accept a URL, to which users will be redirect...