12574 matches found
CVE-2024-2766
A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely...
Campcodes Complete Online Beauty Parlor Management System SQL注入漏洞
Campcodes Complete Online Beauty Parlor Management System is an online beauty parlor management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Online Beauty Parlor Management System version 1.0, which originates from an SQL injection vulnerability in the...
PT-2024-21982 · Unknown · Campcodes Complete Online Beauty Parlor Management System
Name of the Vulnerable Software and Affected Versions: Campcodes Complete Online Beauty Parlor Management System version 1.0 Description: A critical issue has been identified, affecting the /admin/index.php file. The manipulation of the username argument leads to SQL injection. This issue can be...
CVE-2024-2648
A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is...
CVE-2024-28092
UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Ti...
PT-2024-21397 · Netentsec · Netentsec Ns-Asg Application Security Gateway
Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A problematic issue was found in the affected software, where an unknown function of the file /nac/naccheck.php is impacted. The manipulation of the username argument lead...
Netentsec NS-ASG Application Security Gateway Security Vulnerability
Netentsec NS-ASG Application Security Gateway is an application security gateway from China Netentsec. A security vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which stems from the parameter username in the file /nac/naccheck.php, which can lead to incorrect...
CVE-2024-2586
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...
Username Enumeration
Vantage6 is vulnerable to Username Enumeration. This vulnerability is due to inadequate access controls of sensitive information due to the exposure of API routes /recover/lost and /2fa/lost, which allows unauthorized individuals to trigger password or Multi-Factor Authentication MFA token recove...
AMSS++ SQL Injection Vulnerability
AMSS++ is a tool for the office administration support system of Amssplus. An SQL injection vulnerability exists in AMSS++ version 4.31, which originates from an SQL injection vulnerability in the username parameter of the /amssplus/index.php page...
vantage6 vulnerable to a username timing attack on recover password/MFA token
Impact Much like https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost, which send emails to users if they have lost their password or MFA token. Usernames can be...
BradWenqiang HR SQL Injection Vulnerability
HR is a human resources management system by Brad Wenqiang Personal Developer. A SQL injection vulnerability exists in BradWenqiang HR version 2.0, which stems from the fact that incorrect manipulation of the parameter userName can lead to sql injection...
Progress OpenEdge 11.7.x < 11.7.19 / 12.2.x < 12.2.13 / 12.8.x < 12.8.1 (000253075)
The version of Progress OpenEdge installed on the remote host is prior to 11.7.19, 12.2.13, or 12.8.1. It is, therefore, affected by a vulnerability as referenced in the 000253075 advisory. - In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms...
CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...
CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...
CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...
GO-2024-2615 Username enumeration in github.com/IceWhaleTech/CasaOS-UserService
CasaOS-UserService is vulnerable to a username enumeration issue, when an attacker can enumerate the CasaOS username using the application response. If the username is incorrect, the application gives the error 'User does not exist'. If the password is incorrect, the application gives the error...
CVE-2024-1301
SQL injection vulnerability in Badger Meter Monitool affecting versions 4.6.3 and earlier. A remote attacker could send a specially crafted SQL query to the server via the jusername parameter and retrieve the information stored in the database...
PT-2024-17869 · Badger Meter · Badger Meter Monitool
Name of the Vulnerable Software and Affected Versions: Badger Meter Monitool versions 4.6.3 and earlier Description: A remote attacker could send a specially crafted SQL query to the server via the j username parameter and retrieve the information stored in the database. This issue allows an...
