2266 matches found
CVE-2024-29474
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the User Management module...
CVE-2024-29474
OneBlog v2.3.4 contains a stored cross-site scripting (XSS) vulnerability in the User Management module. The root cause is a lack of proper filtering/escaping of user-supplied data, enabling arbitrary web script or HTML execution. Affected version: OneBlog 2.3.4. Documents do not provide exploita...
OneBlog 安全漏洞
OneBlog is a Java blog. A cross-site scripting vulnerability exists in OneBlog v2.3.4, which stems from a lack of effective filtering and escaping of user-supplied data in the User Management module, and can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a...
PT-2024-22920 · Oneblog · Oneblog
Name of the Vulnerable Software and Affected Versions: OneBlog version 2.3.4 Description: A stored cross-site scripting XSS issue was found in the User Management module. This allows for malicious scripts to be stored and executed on the site. Recommendations: For OneBlog version 2.3.4, update to...
CVE-2024-28323
The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection...
PT-2024-22393 · Unknown · Phpgurukul User Registration & Login/User Management System
Name of the Vulnerable Software and Affected Versions: Phpgurukul User Registration & Login and User Management System version 3.1 Description: The issue is related to user input validation in the bwdates-report-result.php file. It retrieves user-provided date inputs without proper validation,...
User Registration & Login and User Management System SQL Injection Vulnerability
User Registration & Login and User Management System is a user management system with an administration panel. Phpgurukul User Registration & Login and User Management System version 3.1 suffers from a SQL injection vulnerability that originates from the bwdates-report-result.php file containing ...
CVE-2024-28323
The vulnerability CVE-2024-28323 affects Phpgurukul User Registration & Login and User Management System v3.1. The bwdates-report-result.php script accepts user-provided date inputs without proper validation, enabling SQL injection via that input path. This could impact data integrity and confide...
CVE-2024-24766
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. I...
CVE-2024-24766
CVE-2024-24766 concerns username enumeration in the CasaOS-UserService login page. Affected software is CasaOS-UserService (the login module) with versions prior to 0.4.7 (specifically 0.4.4.3 through 0.4.7) where the login responses disclosed whether a username exists via distinct error messages...
CVE-2024-24766 CasaOS Username Enumeration
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. I...
CVE-2024-24766 CasaOS Username Enumeration
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. I...
CVE-2024-24766 CasaOS Username Enumeration
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. I...
CVE-2024-24765 CasaOS-UserService allows unauthorized access to any file
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user...
BIT-RABBITMQ-2021-32718 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...
BIT-CODEIGNITER-2020-10793
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown...
Security Bulletin: Information disclosure vulnerability in IBM WebSphere Application Server Liberty affect IBM Business Automation Workflow - CVE-2023-44483
Summary IBM WebSphere Application Server Liberty is shipped as a component of IBM Business Automation Workflow for User Management Services and Process Federation Server. IBM WebSphere Applciation Server Liberty is also the basis for containerized IBM Business Automation Workflow. A security...
Yelp: Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account
The owner of the business account was removed by a low-privilege user who did not have access to the user management module...
Yelp: Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant page
Privilege escalation vulnerability was discovered where a non-owner user without access to user management could invite other users to the restaurant page...