Sql injection

SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookiecart parameter to /index.php/cart/num...

SUSE CVE-2010-2092

SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the...

CVE-2020-21120

SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookiecart parameter to /index.php/cart/num...

Glassdoor: Web Cache Poisoning leads to XSS and DoS

@nokline and @bombon were able to utilize URL parser confusion in combination with reflected XSS under https://glassdoor.com/Job/ and https://glassdoor.com/mz-survey/interview/collectQuestionsinput.htm/ by caching XSS payloads via cookie and header params into a stored XSS for URLs /Award/ and...

CVE-2022-24121

SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...

CVE-2022-24121

SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...

Sql injection

SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...

CVE-2022-24121

SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...

Unified Office Total Connect Now℠ Cookie Parameter SQL Injection

1. Advisory Information Title: Unified Office Total Connect Now℠ Cookie Parameter SQL Injection Advisory ID: CORE-2022-0001 Advisory URL:https://www.coresecurity.com/core-labs/advisories/unified-office-total-connect-sql-injection Date published: 2022-02-01 Date of last update: 2022-02-01 Vendors...

MGASA-2022-0036 Updated phpmyadmin packages fix security vulnerability

A flaw was identified in how phpMyAdmin processes two factor authentication; a user could potentially manipulate their account to bypass two factor authentication in subsequent authentication sessions PMASA-2022-1. A series of weaknesses was identified allowing a malicious user to submit maliciou...

Authentication flaw

Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the...

CVE-2021-44160

The CVE refers to Carinal Tien Hospital Health Report System, whose login page authenticates improperly. A remote attacker can modify the cookie parameter to bypass authentication and gain another general user’s privileges, enabling limited system operations or data modification and making the se...

PT-2021-24054 · Unknown · Carinal Tien Hospital Health Report System

Name of the Vulnerable Software and Affected Versions: Carinal Tien Hospital Health Report System affected versions not specified Description: The system's login page has improper authentication, allowing a remote attacker to acquire another user's privilege by modifying the cookie parameter...

CVE-2021-33842

Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located...

PT-2021-20344 · Circutor · Circutor Sge-Plc1000

Name of the Vulnerable Software and Affected Versions: Circutor SGE-PLC1000 version 0.9.2b Description: The issue allows an attacker to perform operations as an authenticated user due to an improper authentication vulnerability in the cookie parameter. To exploit this, the attacker must be within...

FreeBSD : sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security. (31a7ffb1-a80a-11eb-b159-f8b156c2bfe9)

Earlier versions of Sympa require a parameter named cookie in sympa.conf configuration file. This parameter was used to make some identifiers generated by the system unpredictable. For example, it was used as following : - To be used as a salt to encrypt passwords stored in the database by the RC...

sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security.

Earlier versions of Sympa require a parameter named cookie in sympa.conf configuration file. This parameter was used to make some identifiers generated by the system unpredictable. For example, it was used as following: To be used as a salt to encrypt passwords stored in the database by the RC4...

CVE-2021-25910

Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...

Authentication flaw

Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...

CVE-2021-25910 ZIV AUTOMATION 4CCT vulnerable to improper authentication

Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...