120 matches found
CVE-2023-5561
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack...
UBUNTU-CVE-2023-41326
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with...
Moodle 3.9.x < 3.9.14 Multiple Vulnerabilities
The version of Moodle installed on the remote host is 3.9.x prior to 3.9.14, 3.10.x prior to 3.10.11, 3.11.x prior to 3.11.7 or 4.0.x prior to 4.0.1. It is, therefore, affected by multiple vulnerabilities: - A stored Cross-Site Scripting XSS vulnerability in ID numbers displayed when bulk...
SUSE CVE-2017-7617
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chansip, the CDR dialplan function, and the AMI Monitor action...
SUSE CVE-2019-11454
Persistent cross-site scripting XSS in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an...
CVE-2021-36424
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation...
CVE-2021-36424
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation...
CVE-2021-36424
CVE-2021-36424 affects phpwcms 1.9.25 and allows remote attackers to execute arbitrary code via the DB user field during installation. This is documented across multiple sources (NVD, Red Hat, OSV, CNNVD, CVE listing, PT Security) with no publicly available fix version indicated in the provided m...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the create function, by manipulating the @user field. Remediation Upgrade curupira to version 0.1.4 or higher. References - GitHub Commit - GitHub Release...
Authorization Bypass
github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability exists when the tuples user field is set to userset and the tuple's relation is used on the right-hand side of the from statement which allows an attacker to bypass the authorization mechanism under certain...
Cross site scripting
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews...
CVE-2022-38374
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews...
PT-2022-24823 · Unknown · Parse Server
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.15 Parse Server versions 5.0.0 through 5.2.5 Description: A user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to...
PT-2022-5793 · Fortinet · Fortiadc
Name of the Vulnerable Software and Affected Versions: FortiADC versions 6.2.0 through 6.2.4 FortiADC versions 7.0.0 through 7.0.2 Description: The issue is related to improper neutralization of input during web page generation, allowing an attacker to execute unauthorized code or commands. This...
Input validation
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...
Cisco Small Business 操作系统命令注入漏洞
Cisco Small Business is a switch from Cisco USA. The Cisco Small Business router suffers from an operating system command injection vulnerability that originates from an authenticated, remote attacker utilizing its web-based management interface to insufficiently validate the user field in incomi...
MV Informática IDCE MV SQL注入漏洞
MV Informática IDCE MV is a health management software from the Brazilian company MV Informática. MV Informática IDCE MV version 1.0 contains a SQL injection vulnerability that stems from a SQL injection issue in the user field of the login page. An attacker could exploit the vulnerability to...
CVE-2022-30597
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...
