CVE-2020-25952

SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication...

openGauss: Enabling the Auditing of Database Login and Logout

The parameter auditloginlogout specifies whether to audit user login and logout. After this parameter is set to on, users logged in to the database and the time when they logged out are traced. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

openGauss: Enabling the Logging of User Login

The parameter logconnections specifies whether to record each connection attempt and the successful client connection authentication in server logs. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

WordPress Loginizer log SQLi Scanner

Loginizer wordpress plugin contains an unauthenticated timebased SQL injection in versions before 1.6.4. The vulnerable parameter is in the log parameter. Wordpress has forced updates of the plugin to all servers Module Options msf use auxiliary/scanner/http/wploginizerlogsqli msf...

CVE-2020-9935

CVE-2020-9935 is an Apple/macOS vulnerability affecting the Catalina login window. The Apple/RH documentation attributes the issue to a logic/state-management flaw in the login window, enabling a user to be unexpectedly logged in to another user’s account. The NVD entry mirrors this, noting a sim...

Recommended update for mailman (moderate)

openSUSE Security Update: Recommended update for mailman Announcement ID: openSUSE-SU-2020:1707-1 Rating: moderate References: 1171363 1173369 Cross-References: CVE-2020-12108 CVE-2020-12137 CVE-2020-15011 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities is now...

picketbox: JBoss EAP reload to admin-only mode allows authentication bypass

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user...

CVE-2020-8339

A cross-site scripting inclusion XSSI vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module AMM web interface prior to version 3.68n BPET68N. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a...

DBHcms Cross-Site Scripting Vulnerability (CNVD-2020-49088)

DBHcms is a small, free and open source content management system for personal and small business websites. A stored cross-site scripting vulnerability exists in DBHcms 1.2.0. The vulnerability stems from the failure of a security filter for userlogin to exist in dbhcmsmodmod.users.view.php on li...

CVE-2020-6653

Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can harvest the information and later on can use the information to monitor and control the user's...

Information disclosure

Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can harvest the information and later on can use the information to monitor and control the user's...

Park Ticketing Management System 1.0 - Authentication Bypass

Exploit Title: Park Ticketing Management System 1.0 - Authentication Bypass Date: 2020-07-13 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/park-ticketing-management-system-using-php-and-mysql/ Software...

[SECURITY] Fedora 31 Update: dbus-1.12.18-1.fc31

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

DirectX Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with...

h1-ctf: [H1-2006 2020] CTF Writeup!

The Beginning ===================== The scope of the H1-2006 CTF was .bountypay.h1ctf.com. After opening https://bountypay.h1ctf.com, I noticed that on the top left of the screen there was a dropdown with two login pages: one for Customers https://app.bountypay.h1ctf.com/ and one for Staff...

Palo Alto Networks PAN-OS 7.1.x < 8.1.14 / 8.0.x < 8.1.14 / 8.1.x < 8.1.14 / 9.0.x < 9.0.8 Session Fixation

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.14 or 8.0.x prior to 8.1.14 or 8.1.x prior to 8.1.14 or 9.0.x prior to 9.0.8. It is, therefore, affected by a session fixation vulnerability. - The GlobalProtect Portal feature in PAN-OS does not set a new...

Online Healthcare Patient Record Management System 1.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Healthcare Patient Record Management System 1.0 - Authentication Bypass Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.sourcecodester.com Software Link:...

Yershop Mall has a flawed logic vulnerability

Yershop online store management system is a mall system based on tp5.1 optimized version. Yershop Mall has a logic flaw vulnerability that can be exploited by an attacker to make unauthorized changes to any user name, resulting in the user not being able to log in to their account...

Front-end Arbitrary User Fake Login Vulnerability in Tongda OA

Tongda OA Office Anywhere Network Intelligent Office System is a collaborative office automation software developed by Beijing Tongda Science and Technology Co. Ltd. is a collaborative office automation software developed by the company. Tongda OA front-end arbitrary user forgery login...

Microsoft Windows Media Foundation Information Disclosure Vulnerability (CNVD-2020-26241)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Media Foundation is one of the multimedia application libraries. An information disclosure...