6995 matches found
CVE-2020-8176
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...
Cross site scripting
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...
CVE-2020-8176
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...
CVE-2020-8176
CVE-2020-8176 affects koa-shopify-auth, versions 3.1.61–3.1.62. The vulnerability is an XSS via the shop parameter in /shopify/auth/enable_cookies. Root cause cited across sources is lack of sanitization of the shop value in multiple files (e.g., auth/client/request-storage-access.ts, auth/client...
EulerOS Virtualization 3.0.6.0 : openssh (EulerOS-SA-2020-1719)
According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users ...
MK-AUTH cross-site scripting vulnerability (CNVD-2021-17430)
MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A cross-site scripting vulnerability exists in the admin and client scripts in MK-AUTH version 19.01, which can be exploited by an attacker to execute arbitrary JavaScript code...
Unspecified Vulnerability in MK-AUTH
MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A security vulnerability exists in multiple endpoints of the /admin path in MK-AUTH version 19.01, which can be exploited to execute commands using shell metacharacters...
MK-AUTH Trust Management Issue Vulnerability
MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A trust management issue vulnerability exists in the Web login feature in MK-AUTH version 19.01, which can be exploited to bypass authentication and gain administrator access with the help of the...
MK-AUTH Authorization Issues Vulnerability
MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. An authorization issue vulnerability exists in the Web login feature in MK-AUTH version 19.01, which can be exploited by an attacker to bypass authentication and gain client privileges...
MK-AUTH SQL Injection Vulnerability
MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A SQL injection vulnerability exists in the mkt/ PHP script in MK-AUTH version 19.01, which can be exploited by an attacker to execute illegal SQL commands...
CVE-2020-14071
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...
CVE-2020-14069
An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...
CVE-2020-14068
An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...
CVE-2020-14070
An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...
CVE-2020-14072
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...
CVE-2020-14071
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...
CVE-2020-14072
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...
CVE-2020-14070
An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...
CVE-2020-14069
An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...
Sql injection
An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...