13760 matches found
Cross site scripting
GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a...
CVE-2021-39186
GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a...
CVE-2021-37151
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one aka Username...
CVE-2021-37151
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one aka Username...
Sql injection
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...
CVE-2021-37151
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one aka Username...
Design/Logic Flaw
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one aka Username...
CVE-2021-37151
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one aka Username...
Exploit for Observable Discrepancy in Servicenow
CVE-2021-45901 ServiceNow - Username Enumeration !service-...
CVE-2021-40353
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...
CVE-2021-40353
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...
Sql injection
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...
Open Solutions For Education openSIS SQL注入漏洞
Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education Open Solutions For Education. A SQL injection vulnerability exists in openSIS because the product does not validate the USERNAME parameter on the index.php page. The...
CyberArk Identity 授权问题漏洞
CyberArk CyberArk Identity is CyberArk's provides the most complete identity security platform to secure all identities end-to-end. A security vulnerability exists in CyberArk Identity 21.5.131, which can be exploited by an attacker to obtain a username or password...
in pimcore/pimcore
✍️ Description It is possible to enumerate usernames via the forgot password functionality 🕵️♂️ Proof of Concept When entering an username that is not registered in the application the response reads "User unknown". The following curl command demonstrates this: curl -i -s -k -X $'POST' \ -H...
Cross Site Scripting (XSS) in Quokka
Cross Site Scripting XSS in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'...
GHSA-5M69-3CHG-6F8M Cross Site Scripting (XSS) in Quokka
Cross Site Scripting XSS in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'...
Ship Ferry Ticket Reservation System 1.0 SQL Injection
Exploit Title: Ship Ferry Ticket Reservation System v1.0 SQL-Injection-Bypass-Authentication in /shipticketing/classes/Login.php. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 08.30.2021 Vendor:...
ZesleCP 3.1.9 Remote Code Execution
Title: ZesleCP 3.1.9 - Remote Code Execution RCE Authenticated Date: 27.08.2021 Author: Numan Türle Vendor Homepage: https://zeslecp.com/ Software Link: https://zeslecp.com/ Version: =3.1.9 https://www.youtube.com/watch?v=5lTDTEBVq-0 !/usr/bin/python3 -- coding: utf-8 -- ZesleCP - Remote Code...
SQL Injection - bypass login on B&E Tracker (by: oretnom23 ) v1.0
Description: The B&E Tracker by: oretnom23 v1.0 is vulnerable in the application /expensebudget/classes/Login.php which is called from /expensebudget/dist/js/script.js app. The parameter username from the login form is not protected correctly and there is no security and escaping from malicious...