CVE-2024-11819: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgotpasswordprocess.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploi...

CVE-2024-43784 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

CVE-2024-43784

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

CVE-2024-43784 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

CVE-2024-43784

CVE-2024-43784 affects lakeFS: when creating a new user with a username that previously belonged to a deleted user, the new user inherits all of the deleted user’s credentials. This is fixed in lakeFS release v1.33.0 and later. Affected users should upgrade to ≥1.33.0; if upgrading is not possibl...

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

Impact Existing lakeFS users who have issued credentials to users who have been deleted. Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion. Patches Has the problem been patched? What...

USN-7130-1 gh vulnerability

It was discovered that GitHub CLI incorrectly handled username validation. An attacker could possibly use this issue to perform remote code execution if the user connected to a malicious server. CVE-2024-52308...

USN-7130-1: GitHub CLI vulnerability

It was discovered that GitHub CLI incorrectly handled username validation. An attacker could possibly use this issue to perform remote code execution if the user connected to a malicious server. CVE-2024-52308...

1000 Projects Portfolio Management System: MCA security vulnerabilities

1000 Projects Portfolio Management System MCA is an open source portfolio management system from 1000 Projects. A security vulnerability exists in 1000 Projects Portfolio Management System MCA version 1.0 due to an SQL injection in the parameter username...

PT-2024-17271 · Unknown · Phpgurukul User Registration & Login/User Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/index.php. The manipulation of the username argument leads to SQL injection. The...

PT-2024-17273

Name of the Vulnerable Software and Affected Versions 1000 Projects Portfolio Management System MCA version 1.0 Description A critical issue has been found in the code of the /forgot password process.php file. The manipulation of the username argument leads to a SQL injection. The attack can be...

PT-2024-30654

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.33.0 Description lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this issue...

CVE-2024-43784: Improper Preservation of Permissions

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

CVE-2024-11817: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul User Registration & Login and User Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack may be...

Ubuntu 24.04 LTS / 24.10 : GitHub CLI vulnerability (USN-7130-1)

The remote Ubuntu 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7130-1 advisory. It was discovered that GitHub CLI incorrectly handled username validation. An attacker could possibly use this issue to perform remote code execution if t...

CVE-2024-10116

The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10116 Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter

The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10116: Improper Neutralization of Input During Web Page Generation

The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

WordPress plugin Twitter Follow Button: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress Twitter Follow Button plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via username Parameter vulnerability discovered by Francesco Carlucci in WordPress Plugin Twitter Follow Button versions = 0.2...