CVE-2024-34243

The Konga application (specifically version v0.14.9 ) is vulnerable to Cross-Site Scripting (XSS) due to inadequate input validation on the username parameter. This flaw allows an attacker to inject malicious scripts into the application, which can be executed in the context of a user's browser. ...

CVE-2024-34243

Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...

CVE-2024-4797: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /ajax.php. The manipulation of the argument name/customername/username leads to cross site scripting. The attack can be initiated...

Web-School ERP Cross-site Scripting Vulnerabilities

Web-School ERP is an application from Web-School India, Inc. An ERP application. A cross-site scripting vulnerability exists in Web-School ERP version 1.0, which stems from a cross-site scripting vulnerability in the username and password parameters of the /index.php page...

CVE-2024-4822: Improper Neutralization of Input During Web Page Generation

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session...

PT-2024-25763 · Konga · Konga

Name of the Vulnerable Software and Affected Versions: Konga version 0.14.9 Description: The issue allows for Cross Site Scripting XSS via the username parameter. Recommendations: For Konga version 0.14.9, avoid using the username parameter until the issue is resolved...

CVE-2024-34243: Improper Neutralization of Input During Web Page Generation

Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...

Laundry Management System Cross-Site Script Vulnerability

Laundry Management System is a laundry management system. A cross-site scripting vulnerability exists in Online Laundry Management System version 1.0, which originates from a cross-site scripting vulnerability in the name/customername/username parameter of the /ajax.php file...

CVE-2024-4822

The CVE-2024-4822 vulnerability affects School ERP Pro+Responsive 1.0, enabling cross-site scripting via the username and password parameters in /index.php. The root cause is a reflected XSS that can partially hijack a victim’s browser session. Multiple sources (CVE records and PT-2024-33031) cor...

PT-2024-33031

Name of the Vulnerable Software and Affected Versions School ERP Pro+Responsive version 1.0 Description The issue allows an attacker to partially take control of the victim's browser session through a cross-site scripting XSS attack. This is achieved by exploiting the username and password...

MELSEC iQ-R Series Safety CPU Account Lockout

The vulnerability of the microprogrammed software of MELSEC iQ-R Series Safety CPUs and Series SIL2 Process CPUs is related to an overly restrictive mechanism for blocking user accounts. Exploiting this vulnerability could allow a malicious actor to lock out a user’s account by entering a known...

GHSA-G49Q-JW42-6X85 thelounge may publicly disclose of all usernames/idents via port 113

Per RFC 1413, The unique identifying tuple includes not only the ports, but also the both addresses. Without the addresses, the information becomes both non-unique and public: - If multiple connections happen to use the same local port number which is possible if the addresses differ, the usernam...

thelounge may publicly disclose of all usernames/idents via port 113

Per RFC 1413, The unique identifying tuple includes not only the ports, but also the both addresses. Without the addresses, the information becomes both non-unique and public: - If multiple connections happen to use the same local port number which is possible if the addresses differ, the usernam...

CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

Logpoint security vulnerabilities

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0 that originates from a vulnerability that allows an attacker to enumerate a list of valid usernames by observing the response time of the Forgot Passwor...

CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

CVE-2024-33856

An issue was discovered in Logpoint versions prior to 7.4.0 that allows an attacker to enumerate a valid list of usernames. This vulnerability originates from an Observable Response Discrepancy (CWE-204) at the Forgot Password endpoint, where an attacker can identify valid users by observing vari...

PT-2024-25511 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered in Logpoint where an attacker can enumerate a valid list of usernames by observing the response time at the "Forgot Password" endpoint. Recommendations: For versions prior ...

CVE-2024-33856: Observable Response Discrepancy

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...