PT-2024-31224 · Unknown · Sourcecodehero Event Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodehero Event Management System version 1.0 Description: The issue is related to a SQL Injection vulnerability via the parameter username in the "/event/admin/login.php" endpoint. This allows attackers to remotely compromise databases...

CVE-2024-44727

Sourcecodehero Event Management System 1.0 is vulnerable to an SQL Injection via the username parameter in /event/admin/login.php. Documented across multiple feeds; no patch/version fix details are provided in the supplied materials. Exploitation details, impact, and mitigations beyond the generi...

Sourcecodehero Event Management System security vulnerabilities

Sourcecodehero Event Management System is an open source event management system from Sourcecodehero. A security vulnerability exists in Sourcecodehero Event Management System version 1.0, which is caused by SQL injection via the parameter "username" in /event/admin/login.php...

CVE-2024-44727

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php...

PT-2024-31692 · Identity Automation · Rapididentity Lts +1

Name of the Vulnerable Software and Affected Versions: RapidIdentity LTS versions 2023.0.2 and earlier RapidIdentity Cloud versions 2024.08.0 and earlier Description: The issue allows a remote attacker to cause a denial of service via the username parameters by improperly restricting excessive...

CVE-2024-45589: Improper Restriction of Excessive Authentication Attempts

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

PHPGurukul Job Portal Cross-site Scripting Vulnerability

PHPGurukul Job Portal is a PHP-based job search website system from PHPGurukul. A cross-site scripting vulnerability exists in PHPGurukul Job Portal version 1.0, which originates from the JOBID and USERNAME parameters in /jobportal/process.php...

Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...

CVE-2024-45052

Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

CVE-2024-45052 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability

Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

CVE-2024-45052

Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

CVE-2024-45052 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability

Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

CVE-2024-45052

Affected software : Fides Webserver authentication (part of the Fides platform). Vulnerability : timing-based username enumeration where an unauthenticated attacker can deduce valid usernames by measuring login response times. Root cause / mechanics : observable timing discrepancy between respons...

CVE-2024-8121

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpextchangeadminname function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, wi...

CVE-2024-8106

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the downloaduserajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extra...

CVE-2024-8121 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpextchangeadminname function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, wi...

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.8 - Missing Authorization to Admin Username Change vulnerability

Missing Authorization to Admin Username Change vulnerability discovered by Marco Wotschka in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.8...

CVE-2024-45052: Observable Timing Discrepancy

Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

CVE-2024-6921

The vulnerability CVE-2024-6921 affects NACPremium from NAC Telecommunication Systems Inc. It is a Cleartext Storage of Sensitive Information issue in NACPremium, where embedded sensitive data can be retrieved due to unencrypted storage. Affected release: NACPremium through 01082024. The technica...

Cerberus FTP Server SFTP Username Enumeration

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' class MetasploitModule 'Cerberus FTP Server SFTP Username Enumeration', 'Description' = %q This module uses a dictionary to brute force valid usernames...