OESA-2024-2048 booth security update

Booth manages tickets which authorize cluster sites located in geographically dispersed locations to run resources. It facilitates support of geographically distributed clustering in Pacemaker. Security Fixes: A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is...

CVE-2024-42766

Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php...

Kashipara Bus Ticket Reservation System 安全漏洞

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A cross-site request forgery vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from /deleteTicket.php not adequately verifying that the request comes from a trusted user, and can be...

CVE-2024-42766

Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php...

PT-2024-30134

Name of the Vulnerable Software and Affected Versions Kashipara Bus Ticket Reservation System version 1.0 Online Shopping System version 1.0 Description The issue concerns a Cross Site Request Forgery CSRF vulnerability via the /deleteTicket.php endpoint. This allows for unauthorized actions to b...

PT-2024-30136 · Unknown · Kashipara Bus Ticket Reservation System

Name of the Vulnerable Software and Affected Versions: Kashipara Bus Ticket Reservation System version 1.0 0 Description: The issue concerns Incorrect Access Control, allowing unauthorized actions via the "/deleteTicket.php" API endpoint. This enables unauthorized booking deletions due to broken...

CVE-2024-42764

Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery CSRF via /deleteTicket.php...

CVE-2024-42764

Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery CSRF via /deleteTicket.php...

CVE-2024-42765

A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters...

PT-2024-30135 · Unknown · Kashipara Bus Ticket Reservation System

Name of the Vulnerable Software and Affected Versions: Kashipara Bus Ticket Reservation System version 1.0 Description: A SQL injection vulnerability in the "/login.php" page of the Kashipara Bus Ticket Reservation System allows remote attackers to execute arbitrary SQL commands and bypass login...

CVE-2024-42765

A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters...

CVE-2024-42766

Kashipara Bus Ticket Reservation System v1.0.0 is reported vulnerable to Incorrect Access Control via the /deleteTicket.php endpoint, enabling unauthorized actions such as deleting bookings. The root cause is broken access control; the impact is access/modify/admin actions outside the intended pe...

CVE-2024-42765

The Kashipara Bus Ticket Reservation System v1.0 is vulnerable to a SQL injection vulnerability in the /login.php page. The root cause is the application's failure to properly validate externally-entered SQL statements, specifically via the "email" or "password" parameters. This allows remote att...

CVE-2024-42764

The Kashipara Bus Ticket Reservation System v1.0 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability via the /deleteTicket.php endpoint. The root cause is the failure of the system to adequately verify that requests originate from a trusted user. An attacker can exploit this by for...

CVE-2024-42766: Improper Access Control

Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php...

CVE-2024-42765: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters...

CVE-2024-42764: Cross-Site Request Forgery (CSRF)

Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery CSRF via /deleteTicket.php...

Helpdeskz v2.0.2 - Stored XSS

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

CVE-2024-42762

A Stored Cross Site Scripting XSS vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields...

CVE-2024-42763

A Reflected Cross Site Scripting XSS vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter...