12560 matches found
CVE-2024-49358
ZimaOS (fork of CasaOS) prior to and including 1.2.4 is affected by CVE-2024-49358 due to an API behavior at /v1/users/login that reveals whether a username exists, enabling username enumeration. This is a network-facing issue with CVSS 5.3 (MEDIUM); no patched versions are publicly available per...
CVE-2024-49358 ZimaOS vulnerable to Username Enumeration via API Responses
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can b...
CVE-2024-49358 ZimaOS vulnerable to Username Enumeration via API Responses
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can b...
CVE-2024-49358 ZimaOS vulnerable to Username Enumeration via API Responses
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can b...
CVE-2024-10335
A vulnerability was found in SourceCodester Garbage Collection Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. T...
CVE-2024-10335 SourceCodester Garbage Collection Management System login.php sql injection
A vulnerability was found in SourceCodester Garbage Collection Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. T...
PT-2024-33481 · Zimaos · Zimaos
Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue concerns the API endpoint http:///v1/users/login, which returns distinct responses based on whether a username exists or the password is incorrect. This behavior can be exploited for...
PT-2024-33280 · Zimaos · Zimaos
Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as usernames, through the API endpoint http:///v1/users/name without any authorization. This could be exploited by an...
CVE-2024-20388
A vulnerability in the password change feature of Cisco Firepower Management Center FMC software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker coul...
PT-2024-28773 · Unknown · Vilo 5 Mesh Wifi System
Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions = 5.16.1.33 Description: A Buffer Overflow issue in the local app set router wan function allows remote, unauthenticated attackers to execute arbitrary code. This is achieved by exploiting the pppoe username a...
Vilo 5 Mesh WiFi System 安全漏洞
Vilo 5 Mesh WiFi System is a wireless system from Vilo. A security vulnerability exists in Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier, which stems from the presence of a buffer overflow vulnerability that could allow a remote, unauthenticated attacker to execute arbitrary code via the...
PHPGurukul Boat Booking System SQL注入漏洞
PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Boat Booking System version 1.0, which originates from a SQL injection vulnerability in the username parameter of the /admin/index.php page of the Sign In Page component...
PHPGurukul Boat Booking System SQL注入漏洞
PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. An injection vulnerability exists in version 1.0 of the PHPGurukul Boat Booking System, which originates from an SQL injection vulnerability in the username parameter of the /admin/password-recovery.php page of the Reset You...
OESA-2024-2260 grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attemp...
CVE-2016-15041
The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwpsetuppurchaseusername’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping...
WordPress plugin MainWP Dashboard 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...
PT-2024-10574
Name of the Vulnerable Software and Affected Versions MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to, and including, 3.1.2 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input...
VulnCheck KEV: CVE-2016-15041
The MainWP Dashboard -The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mwpsetuppurchaseusername' parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output...
Code-Projects Blood Bank Management System SQL注入漏洞
Code-Projects Blood Bank Management System is a Code-Projects open source blood bank management system. Code-Projects Blood Bank Management System version 1.0 suffers from a SQL injection vulnerability that originates from the parameter fullname/username/password/email in the file...