CVE-2024-41952 Zitadel has an "Ignoring unknown usernames" vulnerability

Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...

CVE-2024-41952 Zitadel has an "Ignoring unknown usernames" vulnerability

Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...

CVE-2024-39945

A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash...

PT-2024-38228 · Sourcecodester · Sourcecodester Lot Reservation Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lot Reservation Management System version 1.0 Description: A critical issue was found in the system, affecting the file /admin/ajax.php?action=login. The manipulation of the username argument leads to sql injection. This issue...

Establishment Billing Management System SQL注入漏洞

Establishment Billing Management System is a billing management system by oretnom23 Individual Developer. An SQL injection vulnerability exists in the Establishment Billing Management System version 1.0, which stems from an incorrect operation of the username parameter that can lead to sql...

SourceCodester Lot Reservation Management System SQL注入漏洞

SourceCodester Lot Reservation Management System is a parking lot reservation management system from SourceCodester. A SQL injection vulnerability exists in SourceCodester Lot Reservation Management System version 1.0, which stems from an incorrect manipulation of the username parameter that can...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. A security vulnerability exists in ZITADEL that stems from a logic error contained in the Ignoring unknown usernam...

CVE-2024-7127

Improper Neutralization of Input During Web Page Generation vulnerability in Stackposts Social Marketing Tool allows Cross-site Scripting XSS attack. By submitting the payload in the username during registration, it can be executed later in the application panel. This could lead to the unauthoris...

CVE-2024-7219

A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack...

PT-2024-38179

Name of the Vulnerable Software and Affected Versions: SourceCodester School Log Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /admin/ajax.php?action=login. The manipulation of the username argument leads to SQL...

PT-2024-5665 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: The issue is related to a buffer overflow in the formApPortalWebAuth function due to lack of input size validation. This can be exploited by a remote attacker to impact the confidentiality, integrity...

PT-2024-38094 · Unknown · Stackposts Social Marketing Tool

Name of the Vulnerable Software and Affected Versions: Stackposts Social Marketing Tool affected versions not specified Description: The issue allows for a Cross-site Scripting XSS attack due to improper neutralization of input during web page generation. This can be exploited by submitting a...

CVE-2024-7195

A vulnerability was found in itsourcecode Society Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/checkadmin.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The explo...

Society Management System SQL注入漏洞

Society Management System is itsourcecode open source a social management system. Society Management System version 1.0 has a SQL injection vulnerability, the vulnerability stems from the parameter username in the file /admin/checkadmin.php can lead to SQL injection...

SourceCodester School Fees Payment System 安全漏洞

SourceCodester School Fees Payment System is a school fees payment system. A security vulnerability exists in version 1.0 of the SourceCodester School Fees Payment System due to an SQL injection vulnerability in the username parameter of the /ajax.php?action=login file...

Improper Authorization

Streampark is vulnerable to Improper Authorization. The vulnerability is due to the Backend service returning "Authorization" as the front-end authentication credential upon successful login, allowing users to request other users' information, including the administrator's username, password, and...

SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2024:2577-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2577-1 advisory. - CVE-2024-38875: Fixed potential denial-of-service attack via certain inputs with a very large number of brackets bsc1227590 -...

SUSE-SU-2024:2577-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2024-38875: Fixed potential denial-of-service attack via certain inputs with a very large number of brackets bsc1227590 - CVE-2024-39329: Fixed username enumeration through timing difference for users with unusable passwords bsc12275...

Softing Secure Integration Server 1.22 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zip' require 'metasploit/framework/loginscanner/softingsis' class MetasploitModule 'Softing Secure Integration Server v1.22 Remote Code Execution', 'Description...

MAL-2024-12207 Malicious code in asptcer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d894aaf391a92c45f39e6b2e71afaa83b0ea7310e3084ed0a958872a551910e --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, researc...