PT-2024-37939 · Unknown · Sourcecodester Record Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Record Management System version 1.0 Description: A critical issue has been found, affecting an unknown part of the file index.php. The manipulation of the UserName argument leads to sql injection. It is possible to initiate th...

openSUSE 15 Security Update : python-Django (SUSE-SU-2024:2545-1)

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2545-1 advisory. - CVE-2024-38875: Fixed potential denial-of-service attack via certain inputs with a very large number of brackets bsc1227590 - CVE-2024-39329: Fixed...

CVE-2024-40402

A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

Username Enumeration

web-auth/webauthn-framework and web-auth/webauthn-lib are vulnerable to Username Enumeration. The vulnerability is due to the ProfileBasedRequestOptionsBuilder method returning allowedCredentials without any credentials if no username was found. This allows an attacker to enumerate valid username...

CVE-2024-39912

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found...

CVE-2024-39912 Enumeration of valid usernames in web-auth/webauthn-lib

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found...

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

Summary The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. Details When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property i...

Exploit for Server-Side Request Forgery in Havocframework Havoc

CVE-2024-41570: Havoc-C2-SSRF-poc This vulnerability is exploi...

How to Create an ICA File with Minimal Parameters

To create an ICA file with minimal parameters set, complete the following procedure: 1. Download theICA file from this article. 2. Copy the content from this file into anICA file. 3. Update theusername orpassword parameter with the relevant username and password that you use in your environment...

XenMobile: Unable to enroll devices Error: "Username and Password are Incorrect"

User is unable to enroll in XenMobile After entering username and password in SecureHub usersreceive the error: "Incorrect Username and Password are Incorrect" Users are able to authenticate in windows with the same credentials...

How to Mount a CIFS (Windows File System) Share in XenServer Using the Command Line Interface

This article describes how to mount a CIFS Windows file system share in XenServer using the Command Line Interface CLI. Requirements Basic knowledge of Linux Administrator root access to XenServer host using the Command Line Interface CLI Windows username and password to access Windows share to b...

StoreFront Displays Incorrect Username

When there are multiple users with the same log on name in different domains, StoreFront displays incorrect name. For example, if the domain names are domain1\jdoe and domain2\jdoe for John Doe in domain 1 and Jane Doe in domain 2, StoreFront displays the incorrect display name when the user from...

Django 4.x < 4.2.14, 5.x < 5.0.7 Multiple Vulnerabilities - Linux

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

Django 4.x < 4.2.14, 5.x < 5.0.7 Multiple Vulnerabilities - Windows

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

Code-Projects Simple Task List SQL Injection Vulnerability

Code-Projects Simple Task List is a simple task list system from Code-Projects open source. A SQL injection vulnerability exists in Code-Projects Simple Task List version 1.0, which stems from an incorrect manipulation of the parameter username that can lead to sql injection...

FreeBSD : Django -- multiple vulnerabilities (171afa61-3eba-11ef-a58f-080027836e8b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 171afa61-3eba-11ef-a58f-080027836e8b advisory. Django reports: CVE-2024-38875: Potential denial-of-service in django.utils.html.urlize...

CVE-2024-37872

SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sensitive Information Disclosure

directus is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling when using SSO providers in combination with local authentication. An attacker can determine if an email address belongs to an SSO user by observing the error message provided by...

WordPress Unlimited Elements For Elementor plugin <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'username' vulnerability discovered by shaman0x01 in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.112...