SUSE CVE-2022-3930

The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own...

TheRadSystem SQL注入漏洞

TheRadSystem is a Cmput 391 project by saemorris Individual Developer. TheRadSystem suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter user/pass resulting in sql injection...

PT-2022-27077 · Unknown · Simmeth Lieferantenmanager

Name of the Vulnerable Software and Affected Versions: Simmeth Lieferantenmanager versions prior to 5.6 Description: An issue in the design of the API allows a user to fetch arbitrary SQL tables, leaking all user passwords and MSSQL hashes via the "/DS/LM API/api/SelectionService/GetPaggedTab" AP...

Design/Logic Flaw

In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is...

CVE-2022-3930 Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR

The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own...

PT-2022-6293 · Апекс-Вуз · Апекс-Вуз

Name of the Vulnerable Software and Affected Versions: Апекс-ВУЗ affected versions not specified Description: The issue is related to the password reset mechanism in the education automation system, which uses the SHA-1 encryption algorithm with insufficient strength. This could allow a remote...

CVE-2022-4088: Improper Neutralization

A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages/processlogin.php. The manipulation of the argument user/password leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2022-3090

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This coul...

Avaya Scopia Pathfinder 访问控制错误漏洞

Avaya Scopia Pathfinder is a complete firewall and NAT traversal solution from Avaya USA. An Access Control Error vulnerability exists in Avaya Scopia Pathfinder version 8.3.7.0.4, which originates from a compromised access control in user authentication, allowing an unauthenticated, remote...

CVE-2022-3031

An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific...

PT-2022-14472 · Grandstream · Grandstream Gsd3710

Name of the Vulnerable Software and Affected Versions: Grandstream GSD3710 version 1.0.11.13 Description: The issue allows an attacker with knowledge of user and password to overflow the stack, as it does not check the parameter length before using the strcopy instruction. This could lead to an...

PT-2022-22909 · Penta Security Systems Inc · Wapples

Name of the Vulnerable Software and Affected Versions: Penta Security Systems Inc WAPPLES versions 4.0. through 5.0.12. Description: The operating system that WAPPLES runs on has a built-in non-privileged user penta with a predefined password. The password for this user, as well as its existence,...

PT-2022-22250 · Mealie · Mealie

Name of the Vulnerable Software and Affected Versions: Mealie version 1.0.0beta3 Description: The issue allows attackers to modify user passwords and other attributes via modification of the user id parameter. This is due to an Insecure Direct Object Reference IDOR vulnerability. Recommendations:...

CVE-2022-2822 Authentication Bypass by Primary Weakness in octoprint/octoprint

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...

SUSE-SU-2022:2582-1 Security update for samba

This update for samba fixes the following issues: - CVE-2022-32746: Fixed a use-after-free occurring in database audit logging bsc1201490. - CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request bsc1201492. - CVE-2022-2031: Fixed AD restrictions bypass associated with...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

Fruits Bazar SQL注入漏洞

Fruits Bazar is an e-commerce project using Php, javaScript, Jquery and Mysql by Md. Saiful Islam, an individual developer from Bangladesh. A SQL injection vulnerability exists in Fruits Bazar v1.0, which stems from a security issue with the recoveremail parameter in userpasswordrecover.php, whic...

JUNG Smart Visu Server 安全漏洞

JUNG Smart Visu Server is a Smart Visu Server from JUNG. A security vulnerability exists in JUNG Smart Visu Server versions 1.0.804, 1.0.830, 1.0.832, which stems from the fact that a KNX group address can be used with a user-defined password. An attacker exploiting this vulnerability could...

CVE-2022-31795

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the grelfinfo function in grel.php. An attacker is able to influence the username user, password pw, and file-name file parameters and inject special characters...

PowerJob has an unspecified vulnerability

PowerJob is an open source distributed computing and job scheduling framework that allows developers to easily schedule tasks in their own applications. a security vulnerability exists in PowerJob 3.2.2 and prior versions. An attacker could exploit the vulnerability to change an arbitrary user...