D-Link DIR-600M C1 Security Breach

The D-Link DIR-600M C1, among others, is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-600M C1 version 3.08, which stems from a buffer overflow caused by the parameter username in the component Telnet Service...

Signal to shield user phone numbers by default

Chat app Signal will shield user’s phone numbers by default from now on. And, it will no longer be necessary to exchange phone numbers when people want to connect through the app. In November, we reported that Signal was testing usernames to eliminate the need to share your phone number. Signal h...

PT-2024-1919 · D Link · D-Link Dir-600M C1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600M C1 version 3.08 Description: A critical issue has been found in the Telnet Service component of the affected device, caused by a buffer overflow when manipulating the username argument. This can be exploited remotely,...

CVE-2024-1700

A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument username with the input alert"xss" leads to cross site scripting. It is possible to launch the...

WordPress 6.4.3 Username Disclosure Vulnerability

WordPress versions 6.4.3 and below appear to suffer from a REST API related username disclosure vulnerability. Title: wordpress 6.4.3 - Username Disclosure Author: h4shur Vendor Homepage: https://www.wordpress.org Software Link: https://www.wordpress.org/download Version: 6.4.3 and earlier Tested...

CVE-2024-1700: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument username with the input leads to cross site scripting. It is possible to launch the attack...

PT-2024-18233 · Unknown · Keerti1924 Php-Mysql-User-Login-System

Name of the Vulnerable Software and Affected Versions: keerti1924 PHP-MYSQL-User-Login-System version 1.0 Description: A problematic vulnerability was found in the keerti1924 PHP-MYSQL-User-Login-System. The issue affects an unknown function of the file /signup.php. By manipulating the username...

PHP MySQL User Signup Login System Cross-Site Scripting Vulnerability

The PHP MySQL User Signup Login System is a login and registration form using HTML, PHP and MySQL. A cross-site scripting vulnerability exists in PHP MySQL User Signup Login System version 1.0, which originates from a cross-site scripting vulnerability in the parameter username in the file...

WordPress 6.4.3 Username Disclosure

Title: wordpress 6.4.3 - Username Disclosure Author: h4shur date:2024-02-21 Vendor Homepage: https://www.wordpress.org Software Link: https://www.wordpress.org/download Version: 6.4.3 and earlier Tested on: Windows 10 & Google Chrome Category : Web Application Bugs Description : the REST API allo...

MantisBT Host Header Injection vulnerability

Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message. Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744 Workarounds Define $gpath as...

CVE-2023-50306

IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337...

CVE-2023-50306 IBM Common Licensing information disclosure

IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337...

PT-2024-13895 · Ibm · Ibm Common Licensing

Name of the Vulnerable Software and Affected Versions: IBM Common Licensing version 9.0 Description: The issue allows a local user to enumerate usernames due to an observable response discrepancy. Recommendations: For IBM Common Licensing version 9.0, at the moment, there is no information about ...

Security Bulletin: IBM License Key Server Administration Agent vulnerable to username enumeration (CVE-2023-50306)

Summary IBM License Key Server Administration Agent could disclose sensitive information by allowing a user to enumerate usernames. An attacker may use this to determine if a user exists or not. Vulnerability Details CVEID:CVE-2023-50306 DESCRIPTION: IBM Common Licensing could allow a local user ...

SUSE-SU-2024:0525-1 Security update for libssh

This update for libssh fixes the following issues: Update to version 0.9.8 jscPED-7719: Fix CVE-2023-6004: Command injection using proxycommand bsc1218209 Fix CVE-2023-48795: Potential downgrade attack using strict kex bsc1218126 Fix CVE-2023-6918: Missing checks for return values of MD functions...

CVE-2024-23784

Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...

CVE-2024-23784

Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...

CVE-2024-23784: Undefined Security Weakness

Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...

openssh security update

8.0p1-19.0.1.2 - Update patches for CVE-2023-51385, CVE-2023-48795 Orabug: 36256632 8.0p1-19.2 - Forbid shell metasymbols in username/hostname Resolves: CVE-2023-51385 - Fix Terrapin attack Resolves: CVE-2023-48795...

Email Validation Bypass And Preventing Sign Up From Email's Owner

Summary Email validation can easily be bypassed because verifyemailenabled option enable email validation at sign up only. A user changing it's email after signing up and verifying it can change it without verification in /profile. This can be used to prevent legitimate owner of the email address...