75 matches found
CVE-2024-6040 Missing client_id in parisneo/lollms-webui
In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...
CVE-2024-36597
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the clientid parameter at clientStatus.php...
CVE-2024-36597
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the clientid parameter at clientStatus.php...
Aegon Life SQL Injection Vulnerability
Aegon Life is an application from Aegon Life. A SQL injection vulnerability exists in Aegon Life v1.0, which originates from a SQL injection vulnerability in the clientid parameter in clientStatus.php...
CVE-2024-36597: Improper Neutralization of Special Elements used in an SQL Command
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the clientid parameter at clientStatus.php...
CVE-2024-36597
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the clientid parameter at clientStatus.php...
CVE-2024-36597
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the clientid parameter at clientStatus.php...
CVE-2024-22718
Cross Site Scripting XSS vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the clientid parameter in the application URL...
CVE-2024-22718: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the clientid parameter in the application URL...
CVE-2024-0560
A vulnerability was found in 3Scale, when used with Keycloak 15 or RHSSO 7.5.0 and superiors. When the authtype is use3scaleoidcissuerendpoint, the Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO...
Mozilla: paypal client_id And stripe api key indexed on web archive
The paypal clientid and stripe API key have been indexed on the web archive, exposing sensitive data...
GHSA-QHHJ-7HRC-GQJ5 Home Assistant vulnerable to account takeover via auth_callback login
Part of the Cure53 security audit of Home Assistant. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...
CVE-2023-41893
Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...
CVE-2023-41895
Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the redirecturi and clientid parameters. Although the redirecturi validation typically ensures that it matches th...
CVE-2023-41895: Improper Neutralization of Input During Web Page Generation
Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the redirecturi and clientid parameters. Although the redirecturi validation typically ensures that it matches th...
CVE-2023-41893: Exposure of Sensitive Information to an Unauthorized Actor
Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...
Home Assistant Cross-Site Scripting Vulnerability
Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from a security hole in the login page. The vulnerability can be exploited...
CVE-2023-2690: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returnedreuseform.php of the component GET Parameter Handler. The manipulation of the argument clientid leads t...
