989 matches found
ARRIS SBR-AC1900P和ARRIS SBR-AC3200P 操作系统命令注入漏洞
ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS, Inc. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the pptpUserName and pptpPassword parameters in the pptp function failing to properly filter the construct command specia...
PT-2022-18170 · Arris · Sbr-Ac1900P +2
Name of the Vulnerable Software and Affected Versions: Arris routers SBR-AC1900P version 1.0.7-B05 Arris routers SBR-AC3200P version 1.0.7-B05 Arris routers SBR-AC1200P version 1.0.5-B05 Description: A command injection issue was discovered in the pptp function via the pptpUserName and pptpPasswo...
CVE-2022-24710
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...
PT-2022-16820
Name of the Vulnerable Software and Affected Versions Weblate versions prior to 4.11 Description Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper...
CVE-2022-24710: Improper Neutralization of Input During Web Page Generation
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...
CVE-2021-46459
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...
PT-2022-12718
Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0 Description The issue concerns SQL injection vulnerabilities found in the admin/users.php component, specifically when the source parameter is set to add user. These vulnerabilities can be exploited through a crafted POS...
CVE-2022-0270
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups...
CVE-2022-0270
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups...
Sourcecodester Budget And Expense Tracker System SQL注入漏洞
SourceCodester Budget And Expense Tracker System is a web-based application from Carlo Montero's personal developer. SourceCodester Budget and Expense Tracker System is vulnerable in v1.0 due to a lack of SQL data escaping and filtering in the software. An attacker could use the user name field t...
PT-2021-16365
Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 13.1.0.6 Description: The issue allows unauthenticated attackers to perform SQL injection attacks and obtain a list of all users registered on the blog, including their username and email...
CVE-2021-24915: Improper Neutralization of Special Elements used in an SQL Command
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...
CVE-2021-38378
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...
Open-xchange OX App Suite 安全漏洞
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company that allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite. An information disclosure...
The vulnerability in the software web interface of F-Secure Internet Gatekeeper allows a hacker to trigger a service failure.
The vulnerability of the F-Secure Internet Gatekeeper software’s web interface relates to the use of the assert function or similar operators when processing user name parameters. Exploiting this vulnerability allows a malicious actor to trigger a service failure by sending a specially crafted HT...
The vulnerability of the POST request processing mechanism of the enhanced qualified electronic signature service for operating systems “EMIAS” allows a perpetrator to disclose information about the user’s name.
The vulnerability of the POST request processing mechanism of the enhanced qualified electronic signature service for operating systems “EMIAS” is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, acting remotely, to disclose informatio...
CVE-2021-42326
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter...
D-Link DIR-615 information leakage vulnerability
The D-Link DIR-615 is a SOHO wireless router with a maximum transfer rate of 300 Mbps. An information disclosure vulnerability exists in the D-Link DIR-615. The vulnerability can be exploited to obtain user name and password by forging a post request to the /getcfg.php page...
