PT-2022-15647 · Unknown · Sante Pacs Server

Name of the Vulnerable Software and Affected Versions: Sante PACS Server version 3.0.4 Description: This issue allows remote attackers to bypass authentication on affected installations. The flaw exists within the processing of calls to the "login endpoint". When parsing the username element, the...

CVE-2022-32056: Improper Neutralization of Special Elements used in an SQL Command

Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter at process.php...

Improper access control

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login...

DEBIAN-CVE-2022-34911

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

CVE-2022-34911

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

Code injection

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

CVE-2022-34912

An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped...

UBUNTU-CVE-2022-34912

An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped...

CVE-2022-34911

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

CVE-2022-34911

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

CVE-2022-34911: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

MediaWiki cross-site scripting vulnerabilities

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.35.7, which stems from the fact...

PT-2022-22430 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.7 MediaWiki versions 1.36.x MediaWiki versions 1.37.x prior to 1.37.3 MediaWiki versions 1.38.x prior to 1.38.1 Description: An issue can occur in configurations that allow a JavaScript payload in a username,...

PT-2022-22431 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.37.3 MediaWiki versions 1.38.x prior to 1.38.1 Description: An issue was discovered where the contributions-title, used on Special:Contributions, is used as a page title without escaping. This can cause problems ...

CVE-2022-34911

CVE-2022-34911 affects MediaWiki up to versions before 1.35.7, 1.36.x before 1.37.3, and 1.38.x before 1.38.1. The issue allows XSS when a username containing JavaScript is not escaped after account creation, because SpecialCreateAccount::successfulAction() passes a message to showSuccessPage() a...

PT-2022-3282

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8 Description The issue is related to the incorrect use of privileged APIs in the PingID multi-factor authentication MFA software for Windows. This could allow an attacker to elevate their privileges...

LDAP Account Manager LDAP Injection

The vulnerability in the LDAP Account Manager web application exists due to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability allows a malicious actor to use the user’s username field to manipulate LDAP data...

CVE-2021-40597

The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password...

Edimax Technology IC-3140W Trust Management Vulnerability

Edimax Technology Ipcam IC-3140W is a webcam from China-based Edimax Technology. A security vulnerability exists in the Edimax Technology IC-3140W version 3.11, which originates from the use of an administrator's username and password that are hardcoded...

MELAG FTP Server User Enumeration Vulnerability

MELAG FTP Server is an FTP server from the German company MELAG. version 2.2.0.4 of MELAG FTP Server is vulnerable to a user enumeration vulnerability, which stems from the fact that the program presents different responses to users and non-users, and can be exploited by attackers to identify...