SUSE CVE-2019-11454

Persistent cross-site scripting XSS in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an...

CVE-2021-36424

An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation...

CVE-2021-36424

An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation...

CVE-2021-36424

An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation...

CVE-2021-36424

CVE-2021-36424 affects phpwcms 1.9.25 and allows remote attackers to execute arbitrary code via the DB user field during installation. This is documented across multiple sources (NVD, Red Hat, OSV, CNNVD, CVE listing, PT Security) with no publicly available fix version indicated in the provided m...

CVE-2021-36424: Improper Control of Generation of Code

An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the create function, by manipulating the @user field. Remediation Upgrade curupira to version 0.1.4 or higher. References - GitHub Commit - GitHub Release...

Authorization Bypass

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability exists when the tuples user field is set to userset and the tuple's relation is used on the right-hand side of the from statement which allows an attacker to bypass the authorization mechanism under certain...

CVE-2022-38374

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews...

PT-2022-24823 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.15 Parse Server versions 5.0.0 through 5.2.5 Description: A user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to...

PT-2022-5793 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 6.2.0 through 6.2.4 FortiADC versions 7.0.0 through 7.0.2 Description: The issue is related to improper neutralization of input during web page generation, allowing an attacker to execute unauthorized code or commands. This...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

Cisco Small Business 操作系统命令注入漏洞

Cisco Small Business is a switch from Cisco USA. The Cisco Small Business router suffers from an operating system command injection vulnerability that originates from an authenticated, remote attacker utilizing its web-based management interface to insufficiently validate the user field in incomi...

MV Informática IDCE MV SQL注入漏洞

MV Informática IDCE MV is a health management software from the Brazilian company MV Informática. MV Informática IDCE MV version 1.0 contains a SQL injection vulnerability that stems from a SQL injection issue in the user field of the login page. An attacker could exploit the vulnerability to...

PT-2022-20143

Name of the Vulnerable Software and Affected Versions IDCE MV's application version 1.0 Description The issue allows an attacker to inject SQL payloads in the user field of the Logon Page, potentially connecting to a database to access the enterprise's private and sensitive information...

CVE-2022-30597

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...

CVE-2022-30597

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...

UBUNTU-CVE-2022-30597

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...

CVE-2022-30597

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field...