200 matches found
PT-2020-17269 · Unknown · The Online Marriage Registration System
Name of the Vulnerable Software and Affected Versions: The Online Marriage Registration System version 1.0 Description: The issue concerns a Time Based Sql Injection vulnerability in the searchdata post parameter of the "user/search.php" request. This vulnerability allows for potential...
iSmartgate PRO Cross-Site Request Forgery Vulnerability (CNVD-2021-01047)
The iSmartgate PRO is a smart garage door opening system. A cross-site request forgery vulnerability exists in iSmartgate PRO 1.5.9. An attacker can exploit this vulnerability to conduct a cross-site request forgery attack via the busca parameter in a form used to search for users...
CVE-2020-12282
iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. This can be combined with reflected XSS...
CVE-2019-4091
"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "...
githubFind3r - Fast Command Line Repo/User/Commit Search Tool
githubFind3r is a very fast command line repo/user/commit search tool Installation git clone https://github.com/atmoner/githubFind3r.git cd githubFind3r npm install Run it node githubFind3r.js Download githubFind3r...
IBM: SQL Injection and plaintext passwords via User Search
An identified SQL Injection vulnerability was reported to IBM found within an IBM asset. It has been analyzed, and resolved. We thank the xyantix for reporting this vulnerability...
CVE-2018-20508
CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters...
Apache Syncope Information Disclosure Vulnerability (CNVD-2018-18783)
Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope suffers from an information disclosure vulnerabili...
PvPGN Stats SQL Injection Vulnerability
PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program not filtering databa...
CVE-2017-18287
An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST usersearch parameter...
Valve: Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name
Dear Valve security staff, Short description --------------------- There is a stored cross-site-scripting vulnerability present at the user search endpoint which can be exploited by modifying profile name of the would be attacking account. See POC picture. Steps to reproduce ---------------------...
Design/Logic Flaw
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...
CVE-2018-1322
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...
CVE-2018-1322
CVE-2018-1322 affects Apache Syncope: 1.2.x before 1.2.11, 2.0.x before 2.0.8, and some unsupported releases (1.0.x, 1.1.x). The vulnerability allows an administrator with user-search entitlements to recover sensitive security values by manipulating the fiql and orderby parameters. The provided d...
CVE-2018-1322
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...
spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password
A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password. When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with...
CVE-2017-8028
In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting...