12604 matches found
Send message in chat function with any username
Description In chat function, username is not validated. We can change username to any value we want which not match with logged in user. Exploitation steps: 1. Login with Phil1 account Patient account. 2. Send message via Burpsuite proxy 3. Modify username to any value you want I user "n00b" 4. ...
CVE-2022-34047
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd...
CVE-2022-34046
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...
CVE-2022-34046
The CVE-2022-34046 issue affects WAVLINK WN533A8 (M33A8.V5030.190716). It is an improper access control vulnerability enabling an attacker to retrieve usernames and passwords by inspecting view-source:http:///sysinit.shtml?r=52300 and spotting logincheck(user);. Impact could include unauthorized ...
CVE-2022-34046
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...
The vulnerability of the Apache Tomcat application server’s Realm implementation, related to information disclosure due to mismatches, allows attackers to determine all existing user names.
The vulnerability of the Apache Tomcat application server’s Realm implementation is related to the exposure of information through mismatches. Exploiting this vulnerability allows a remote attacker to discover all existing user names...
Garage Management System SQL注入漏洞
SourceCodester Garage Management System Cms-Website is a garage management system by mayurik personal developer. It can help you manage all your vehicles, cars and motorcycles. A security vulnerability exists in Garage Management System 1.0, which stems from unknown code affecting the file...
CVE-2022-30623
The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password...
Easy Username Updater < 1.0.5 - Arbitrary Username Update via CSRF
The plugin does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin...
Chcnav P5E GNSS 信任管理问题漏洞
Chcnav P5E GNSS is a Global Positioning System from Chcnav. The Chcnav P5E GNSS suffers from a security vulnerability that can be exploited by an attacker to extract usernames and passwords already on the user's operating system from the FW...
Easy Username Updater < 1.0.5 - Arbitrary Username Update via CSRF
The plugin does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin PoC...
WordPress Easy Username Updater plugin <= 1.0.4 - Arbitrary Username Update via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Username Update via Cross-Site Request Forgery CSRF vulnerability discovered by Raad Haddad in WordPress Easy Username Updater plugin versions = 1.0.4. Solution Update the WordPress Easy Username Updater plugin to the latest available version at least 1.0.5...
CVE-2022-30982
An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username...
CVE-2022-30982
An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username...
Cross site scripting
An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username...
CVE-2022-26656
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join...
CVE-2022-30622
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...
CVE-2022-26656
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join...
CVE-2022-26656
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join...
AZL-44649 CVE-2022-30550 affecting package dovecot 2.3.20-1
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect usernamefilter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead...