16021 matches found
CVE-2024-37570
On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update upgrade.html page does not perform sanitization on the username and path parameters sent by an authenticated user before appending flags to the busybox ftpget command. This leads to $ command execution...
DEBIAN-CVE-2024-5458
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as filtervar when validating URLs FILTERVALIDATEURL for certain types of URLs the function will result in invalid user information username + password part of URLs being...
Sourcecodester Stock Management System SQL Injection Vulnerability
Sourcecodester Stock Management System is an inventory management system. A SQL injection vulnerability exists in SourceCodester Stock Management System version 1.0, which originates from an unknown function in index.php in the component Login that allows an attacker to perform SQL injection via...
CVE-2024-3102
A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter during the login process at the /api/request-token endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks...
CVE-2024-3102 JSON Injection in mintplex-labs/anything-llm
A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter during the login process at the /api/request-token endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks...
PT-2024-23727 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: A JSON Injection issue exists in the application, specifically within the username parameter during the login process at the "/api/request-token" endpoint. This issue...
CVE-2024-3102: Improper Restriction of Excessive Authentication Attempts
A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter during the login process at the /api/request-token endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks...
CVE-2024-4220
Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames...
SUSE CVE-2022-39229
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user's username and email address are unique fields, th...
CVE-2024-4220: Exposure of Sensitive Information to an Unauthorized Actor
Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames...
PT-2024-40166 · Symfony +1 · Symfony +1
Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 2.0.6 Description: The issue allows a user to switch to another user's account by changing their username via a form to an existing username, resulting in a validation error but modifying the user object in the sessi...
PT-2024-40518 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns an Authentication Bypass in the Salted Password system extension of TYPO3. This occurs when using hashing methods related by PHP class inheritance. Specifically, stored...
PT-2024-40190 · Packagist · Typo3/Cms-Core
Name of the Vulnerable Software and Affected Versions: No specific software or version information is provided. Description: The issue arises from improper encoding of user input, making the login status display susceptible to cross-site scripting in the website frontend. To exploit this, a valid...
tigervnc security update
1.13.1-10 - Drop patches that are already part of xorg-x11-server Resolves: RHEL-30755 Resolves: RHEL-30767 Resolves: RHEL-30761 1.13.1-9 - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents Resolves: RHEL-30755 - Fix CVE-2024-31083 tigervnc...
Oracle Linux 8 : tigervnc (ELSA-2024-3261)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3261 advisory. - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents Resolves: RHEL-30755 - Fix CVE-2024-31083...
CVE-2024-35511
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php...
CVE-2024-35511
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php...
CVE-2024-35511: Improper Neutralization of Special Elements used in an SQL Command
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php...
Oracle Linux 8 : openssh (ELSA-2024-3166)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3166 advisory. - Providing a kill switch for scp to deal with CVE-2020-15778 Resolves: RHEL-22870 Tenable has extracted the preceding description block directly from the Oracl...
