Hospital Management System user-login.php File SQL Injection Vulnerability

Hospital Management System a hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from an unknown function in the file user-login.php, where manipulation of the parameter username can lead to SQL injection. An attacker can use this...

CVE-2024-8569

CVE-2024-8569 affects code-projects Hospital Management System 1.0, specifically the user-login.php file. The issue arises from unsafely handling the username parameter, enabling SQL injection via a remote attack. Multiple sources describe this as a critical vulnerability with public exploits and...

CVE-2024-8569 code-projects Hospital Management System user-login.php sql injection

A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file user-login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely...

Hospital Management System SQL注入漏洞

Hospital Management System a hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from an unknown function in the file user-login.php, where manipulation of the parameter username can lead to SQL injection. An attacker can use this...

PT-2024-39106 · Code Projects · Hospital Management System

Name of the Vulnerable Software and Affected Versions: code-projects Hospital Management System version 1.0 Description: A critical issue has been found in the Hospital Management System, affecting an unknown functionality of the file user-login.php. The manipulation of the username argument lead...

SAML authentication bypass via Incorrect XPath selector

Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrar...

GO-2022-0340 User login denial of service in github.com/google/fscrypt

User login denial of service in github.com/google/fscrypt...

Cannot download source for Citrix Hypervisor hotfixes

The Hotfix Source link in articles for Citrix Hypervisor 8.2 Cumulative Update 1 hotfixes hangs when attempting to download the hotfix source file. This problem occurs whether or not the user is logged in to their Citrix account through the Log In link provided on support.citrix.com...

CVE-2024-2259

CVE-2024-2259 affects InstaRISPACS Web UI: insufficient validation of the loginTo parameter in the user login module permits reflected XSS via crafted input. Impact involves potential confidentiality/integrity loss with HIGH subsequent impacts and UI interaction required; CVSS 4.0 base shows 6.4 ...

CVE-2024-2259 Reflected XXS Vulnerability in InstaRISPACS Software

This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerabl...

CVE-2024-42493

Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login...

CVE-2024-42493

CVE-2024-42493 affects Dorsett Controls InfoScan. The vulnerability is an exposure/leak of sensitive information via response headers and pre-login JavaScript in InfoScan versions prior to 1.38 (notably v1.32/v1.33/v1.35). Red Hat and ICS advisories corroborate exploitation risk and classify the ...

CVE-2024-42493 Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized Actor

Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login...

CVE-2024-42349 FOG has a Log Information Disclosure

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server fogloginaccepted.log and fogloginfailed.log...

CVE-2024-6635

CVE-2024-6635 affects the WooCommerce - Social Login plugin for WordPress. Versions up to and including 2.7.3 are vulnerable due to insufficient controls in the woo_slg_login_email function, enabling unauthenticated users to log in as any existing user except administrators if they know the user’...

CVE-2024-6635 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'wooslgloginemail' function. This makes it possible for unauthenticated attackers to log in as any existing user on the...

CVE-2024-29178

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...

Command Injection

org.apache.streampark:streampark is vulnerable to Command Injection. The vulnerability is caused due to insufficient input parameter validation, allowing attackers to insert commands. Exploiting this requires system-level access via user login, thereby limiting its risk due to controlled user...

CVE-2024-29737

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...