312 matches found
U.S. Dept Of Defense: IDOR on https://██████ via POST UID enables database scraping
Summary: The UID parameter on █████████ in the ██████ ███████ system, with ███████, does not validate that the caller has permission to view information on the UID entered, thereby enabling personnel and student data extraction. Description: The user operations API endpoint for the ███ ██████████...
CVE-2011-4820
IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences...
CVE-2011-4820: Undefined Security Weakness
IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences...
SQL Injection Vulnerability in admin.php of Jinwei Mobile Mall System Version 0.2.4
Jinwei mobile mall system is a micro-business customers with a public number, imitation hand Tao page layout, support embedded video playback. Support customized model specifications, the main specifications support attached pictures, each subdivided model support inventory control, subdivided...
CVE-2019-14266
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
CVE-2019-14266
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
Sql injection
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
CVE-2019-14266
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
CVE-2019-14266
OpenSNS v6.1.0 is affected by an SQL injection in the index.php?s=/ucenter/Config/ uid parameter caused by the getNeedQueryData function in Application/Common/Model/UserModel.class.php. The issue enables manipulation of SQL queries via the uid parameter, as documented by multiple sources (e.g., C...
CVE-2018-13294
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...
CVE-2018-13294
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...
PT-2019-8959
Name of the Vulnerable Software and Affected Versions Synology Application Service versions prior to 1.5.4-0320 Description The issue allows remote authenticated users to obtain sensitive system information. This is achieved via the uid parameter. Recommendations For versions prior to 1.5.4-0320,...
CVE-2018-13294: Exposure of Sensitive Information to an Unauthorized Actor
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...
CVE-2018-18084
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
CVE-2018-18084
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
Sql injection
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
CVE-2018-18084
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
CVE-2018-18084
An SQL injection vulnerability exists in DuomiCMS 3.0 within the ajax.php file. The flaw is triggered via the uid parameter, which allows for improper neutralization of special elements used in an SQL command. This vulnerability has been observed in the wild and identified in honeypot environment...
PT-2018-14339
Name of the Vulnerable Software and Affected Versions DuomiCMS version 3.0 Description An issue exists in the software, specifically a SQL injection in the ajax.php file. This is demonstrated by the uid parameter. Recommendations For DuomiCMS version 3.0, consider restricting access to the ajax.p...
CVE-2018-18084: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...