CVE-2023-7226

A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be...

PT-2023-30299 · Nats +1 · Nats Nats-Server +1

Name of the Vulnerable Software and Affected Versions: NATS nats-server versions 2.2.0 through 2.9.22 NATS nats-server versions 2.10.0 through 2.10.1 Description: The issue is related to an authentication bypass in NATS nats-server. An implicit $G user in an authorization block can sometimes be...

PT-2023-32047

Name of the Vulnerable Software and Affected Versions SATO CL4NX-J Plus version 1.13.2-u455 r2 Description A critical issue has been found in the Cookie Handler component, allowing for improper authentication when the input auth=user,level1,settings; web=true is manipulated. This requires access ...

CVE-2023-5328: Improper Authentication

A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455r2. This affects an unknown part of the component Cookie Handler. The manipulation with the input auth=user,level1,settings; web=true leads to improper authentication. Access to the local network is required for...

CVE-2022-30352

phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...

PT-2022-20072

Name of the Vulnerable Software and Affected Versions phpABook version 0.9i Description The issue arises from insufficient sanitization of user-supplied data in the auth user parameter, leading to SQL Injection. This occurs in the index.php script. Recommendations For phpABook version 0.9i,...

NEC UNIVERGE UM4730 < 11.8 - SQL Injection

Exploit Title: NEC UNIVERGE UM4730 11.8 SQL injection Vulnerbility: SQL injection login bypass Date: 15-12-2016 Exploit Author: b0x41s Author web: https://www.xrayit.nl Vendor Homepage: https://www.nec-enterprise.com Category: webapps Version: 11.6.0.31 Tested on: Windows server 2008 Description:...

PT-2017-7049

Name of the Vulnerable Software and Affected Versions PgBouncer versions 1.6.x before 1.6.1 Description The issue allows remote attackers to gain login access as auth user via an unknown username when PgBouncer is configured with auth user. Recommendations For PgBouncer versions 1.6.x before 1.6....

Cloudera HUE Session cookies stored in the database

User session cookies are stored in the database. Combined with the vulnerability related to configuration file which is world readable, it is possible to spoof a user across the entire cluster launching jobs and browsing the datalake, without having to crack password hashes. Cookies are stored in...

PYSEC-2015-4

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

PT-2015-4526 · Django +1 · Django +1

Name of the Vulnerable Software and Affected Versions: Django versions 1.4.17 and earlier Django versions 1.6.x before 1.6.10 Django versions 1.7.x before 1.7.3 Description: The issue allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in a...

UBUNTU-CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

PT-2011-4922

Name of the Vulnerable Software and Affected Versions iTop versions 1.1.181 through 1.2.0-RC-282 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various means, including: - ...