12587 matches found
HealthMateWeb 跨站脚本漏洞
HealthMateWeb is a web application used in conjunction with HealthMate's Android application. HealthMateWeb suffers from a cross-site scripting vulnerability that stems from unknown functionality in the file createaccount.php, where manipulation of the parameters...
CVE-2022-2666
A vulnerability has been found in SourceCodester Loan Management System and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2015-10027
A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is...
Information disclosure
A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is...
CVE-2015-10027 hydrian TTRSS-Auth-LDAP Username ldap injection
A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is...
CVE-2015-10027 hydrian TTRSS-Auth-LDAP Username ldap injection
A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is...
PT-2023-10206 · Hydrian · Ttrss-Auth-Ldap
Name of the Vulnerable Software and Affected Versions: hydrian TTRSS-Auth-LDAP versions prior to 2.0b1 Description: A problematic issue has been found in the Username Handler component, leading to ldap injection. The estimated number of potentially affected devices is not specified. There is no...
Loan Management System SQL注入漏洞
Loan Management System is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System version 1.0, which originates from unknown code in the file login.php that manipulates the parameter username to cause SQL injection...
Aruba Networks ClearPass Policy Manager 授权问题漏洞
Aruba Networks ClearPass Policy Manager is an Aruba Networks application that provides a secure access management system for wireless networks. A security vulnerability exists in Aruba Networks ClearPass Policy Manager. An attacker could use this vulnerability to bypass authentication and log in ...
PT-2023-18509 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 3.0.0.beta16 on the beta and tests-passed branches Description: The issue exposes the number of times a user posted in an arbitrary topic to unauthorized user...
Discourse 信息泄露漏洞
Discourse is an open source community discussion platform. The platform includes features such as communities, email, and chat rooms. Discourse suffers from an information disclosure vulnerability that stems from the number of times it allows users posted in any thread to be exposed to unauthoriz...
Lead Management System SQL Injection Vulnerability
Lead management system is a lead management system developed by Mayuri K. The Lead Management System version 1.0 is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the login.php parameter username, and can be exploited by attackers to The...
Vulnerabilities fixed in Snipe-IT
Several vulnerabilities have been fixed in Snipe-IT. The vulnerabilities allow a remote malicious person to launch an XSS attack and to retrieve usernames. To exploit the XSS vulnerability, the malicious party must be authenticated and have rights to Accessory and Consumables to modify. The...
CVE-2022-4855
A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
PT-2022-28140 · Sourcecodester · Sourcecodester Loan Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Lead Management System version 1.0 Description: A critical issue was found in the SourceCodester Lead Management System. The manipulation of the username argument in the login.php file leads to sql injection. This issue can be...
GHSA-CM9X-C3RH-7RC4 CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation
Impact It is possible to craft an environment variable with newlines to add entries to a container's /etc/passwd. It is possible to circumvent admission validation of username/UID by adding such an entry. Note: because the pod author is in control of the container's /etc/passwd, this is not...
memos 访问控制错误漏洞
memos is an open source hosted memo center with knowledge management and social features. An access control error vulnerability exists in versions of memos prior to 0.9.1, which can be exploited by an attacker to change any user's email and username, as well as display name...
PT-2022-28110 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to improper access control in the usememos/memos GitHub repository. This allows for full account takeover by changing the user name, email address, and display name...
rdiffweb vulnerable to Authentication Bypass by Primary Weakness
In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access...