Web Port 授权问题漏洞

Web Port is a web-based SCADA data acquisition and monitoring system and HMI human machine interface system. A security vulnerability exists in Cynet 360 Web Portal versions prior to v4.5, which stems from a vulnerability that allows an attacker to access a list of excluded files and configuratio...

CVE-2022-36750

Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/updateuser.php?id=...

PT-2022-23604 · Unknown · Clinic'S Patient Management System

Name of the Vulnerable Software and Affected Versions: Clinic's Patient Management System version 1.0 Description: The issue concerns a SQL injection vulnerability. It can be exploited via the /pms/update user.php endpoint, specifically through the id parameter. Recommendations: For Clinic's...

Patient Records Management System SQL注入漏洞

Sourcecodester Hospital Patient Records Management System is a Web-based application that provides hospitals with an automated platform to store and manage their patient records. Management System is vulnerable to SQL injection, which originates from /hprms/admin/?page=user/manageuser&id= page...

Design/Logic Flaw

Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire...

Statamic 加密问题漏洞

Statamic is a powerful flat file Cms built on Laravel by Statamic, Inc. for storing all content, templates, assets, and settings in a file instead of a database. Statamic suffers from a security vulnerability that stems from the fact that prior to versions 3.2.39 and 3.3.2, it was possible to...

CVE-2021-44667

A Cross Site Scripting XSS vulnerability exists in Nacos 2.0.3 in auth/users via the 1 pageSize and 2 pageNo parameters...

CVE-2022-22296

Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manageuser endpoint. Simply change the value and data of other users can be displayed...

CVE-2022-22296

Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manageuser endpoint. Simply change the value and data of other users can be displayed...

CVE-2020-20595

A cross-site request forgery CSRF in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add...

CVE-2021-35491

A Cross-Site Request Forgery CSRF vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolv...

Wowza Media Systems Wowza Streaming Engine 跨站请求伪造漏洞

Wowza Media Systems Wowza Streaming Engine is a powerful, customizable and scalable media server software from Wowza Media Systems, USA. It is used to reliably stream high-quality video and audio to any device, anywhere. A cross-site request forgery vulnerability exists in Wowza Streaming Engine...

Autumn 安全漏洞

Autumn is a collection of Web subsystems designed to provide general purpose Web system solutions. A security vulnerability exists in Autumn v1.0.4 and earlier versions that stems from incorrect access control. The vulnerability allows remote attackers to obtain plaintext login credentials via th...

Eigen NLP 安全漏洞

Eigen NLP is a natural language processing system. A security vulnerability exists in Eigen NLP 3.10.1 that stems from the lack of access control on the /auth/v1/user/user-guid/ user edition endpoint. The vulnerability could allow any logged-in user to increase their own permissions via the...

CVE-2021-27731

Accellion FTA 912432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA912444 and later...

Accellion FTA 跨站脚本漏洞

Accellion FTA is an enterprise content firewall from Accellion USA, Inc. provides a protection against data leaks and breaches from third-party network risks. A cross-site scripting vulnerability exists in Accellion FTA 912432 and earlier, which stems from a stored XSS via a POST request to the...

PT-2021-11960 · Unknown · Jupyterhub

Name of the Vulnerable Software and Affected Versions: JupyterHub version 1.1.0 Description: The issue allows for CSRF in the admin panel via a request that lacks an xsrf field. This can be demonstrated by a "/hub/api/user" request, which can be used to add or remove a user account...

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...

glpi -- able to read any token through API user endpoint

MITRE Corporation reports: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges escalations or...

CVE-2019-19990

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Stored Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/sheadmodel.php and /vam/vamuser.php...