26 matches found
hikvision_CVE-2017-7921_auth_bypass_config_decryptor
hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...
CVE-2026-90495
Fengoffice Feng Office versions up to 3.11.13.11 contain a SQL injection vulnerability in the Legacy API component, specifically in the function Contacts::instance->findAll within the file application/models/CompanyWebsite.class.php. Manipulation of the auth argument allows a remote, unauthent...
CVE-2026-90495 Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...
EUVD-2026-55225
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gh9f-6xm2-c4j2. This link is maintained to preserve external references. Original Description SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE...
The vulnerability of the yiisoft/yii2-redis framework in Yii, which allows attackers to expose protected information.
The vulnerability of the yiisoft/yii2-redis framework in Yii is related to the exposure of information through registration files. Exploiting this vulnerability allows a malicious actor to disclose protected information through the AUTH parameter...
yii2-redis 日志信息泄露漏洞
yii2-redis is an extension to yii open source. A log information disclosure vulnerability exists in yii2-redis versions prior to 2.0.20, which stems from the explicit logging of the AUTH parameter in the logs, which could lead to credential disclosure...
moonmoon security breach
moonmoon is a web-based aggregator similar to Planetplanet. It can be used to mix posts from different blogs with the same interests into a single page. A security vulnerability exists in moonmoon, which stems from an incorrect comparison of the auth parameter on the admin/inc/auth.inc.php page...
CVE-2023-51049
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
CVE-2021-44266: Improper Neutralization of Input During Web Page Generation
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
PT-2022-12035
Name of the Vulnerable Software and Affected Versions GUnet Open eClass versions prior to 3.12.2 Description The issue allows for XSS via the auth parameter in the modules/auth/formuser.php file. Recommendations For versions prior to 3.12.2, update to version 3.12.2 or later to resolve the issue...
CVE-2019-10196: Improper Initialization
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...
CentOS 8 : squid:4 (CESA-2019:3476)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3476 advisory. - squid: XSS via username or auth parameter in cachemgr.cgi CVE-2019-13345 Note that Nessus has not tested for this issue but has instead relied only on the...
squid: XSS via user_name or auth parameter in cachemgr.cgi
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
RHEL 8 : squid:4 (RHSA-2019:3476)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3476 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: XSS via...