16012 matches found
CVE-2024-48932: Improper Access Control
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint http:// /v1/users/name allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be...
CVE-2024-49358: Observable Discrepancy
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:// /v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can ...
PT-2024-33280 · Zimaos · Zimaos
Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as usernames, through the API endpoint http:///v1/users/name without any authorization. This could be exploited by an...
CVE-2024-20388
A vulnerability in the password change feature of Cisco Firepower Management Center FMC software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker coul...
PT-2024-28773 · Unknown · Vilo 5 Mesh Wifi System
Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions = 5.16.1.33 Description: A Buffer Overflow issue in the local app set router wan function allows remote, unauthenticated attackers to execute arbitrary code. This is achieved by exploiting the pppoe username a...
Vilo 5 Mesh WiFi System has security vulnerabilities
Vilo 5 Mesh WiFi System is a wireless system from Vilo. A security vulnerability exists in Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier, which stems from the presence of a buffer overflow vulnerability that could allow a remote, unauthenticated attacker to execute arbitrary code via the...
CVE-2024-10156: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Sign In Page. The manipulation of the argument username leads to sql injection. The attack can be initiated...
PHPGurukul Boat Booking System SQL Injection Vulnerability
PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Boat Booking System version 1.0, which originates from a SQL injection vulnerability in the username parameter of the /admin/index.php page of the Sign In Page component...
PHPGurukul Boat Booking System SQL Injection Vulnerability
PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. An injection vulnerability exists in version 1.0 of the PHPGurukul Boat Booking System, which originates from an SQL injection vulnerability in the username parameter of the /admin/password-recovery.php page of the Reset You...
CVE-2024-10157: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/password-recovery.php of the component Reset Your Password Page. The manipulation of the argument username/mobileno leads to sql injection...
OESA-2024-2260 grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attemp...
CVE-2016-15041
The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwpsetuppurchaseusername’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping...
WordPress plugin MainWP Dashboard cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...
PT-2024-10574
Name of the Vulnerable Software and Affected Versions MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to, and including, 3.1.2 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input...
CVE-2024-9986: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file memberregister.php. The manipulation of the argument fullname/username/password/email leads to sql injection. The attack may be...
Code-Projects Blood Bank Management System SQL Injection Vulnerability
Code-Projects Blood Bank Management System is a Code-Projects open source blood bank management system. Code-Projects Blood Bank Management System version 1.0 suffers from a SQL injection vulnerability that originates from the parameter fullname/username/password/email in the file...
PT-2024-39983
Name of the Vulnerable Software and Affected Versions code-projects Blood Bank Management System version 1.0 Description A critical issue affects the processing of the file member register.php, where the manipulation of the fullname, username, password, and email arguments leads to SQL injection...
PT-2024-10842
Name of the Vulnerable Software and Affected Versions Ultimate Membership Pro plugin for WordPress versions 7.3 through 8.6 Description The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass. This makes it possible for unauthenticated attackers to login as any use...
VulnCheck KEV: CVE-2016-15041
The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwpsetuppurchaseusername’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping...
CVE-2024-44734: Origin Validation Error
Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the server...