EUVD-2018-2882

Malware in sbrugna...

EUVD-2018-3017

Malware in sbrugna...

CVE-2021-4290 DHBW Fallstudie Login passport.js sql injection

A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is...

Dedos-web Hardcoded Password Vulnerability

Dedos-web is a set of online tools for executing programs designed using DEDOS-Editor. A security vulnerability exists in version 1.0 of Dedos-web. The vulnerability stems from the program's use of the Passport.js package to provide authentication policies. An attacker can exploit the vulnerabili...

GamerPolls Removes Use of Hardcoded Exploits

GamerPolls is a polling stats graph display plugin. A security vulnerability exists in GamerPolls version 0.4.6 that stems from the program's use of the Passport.js package to provide authentication policies. An attacker can exploit the vulnerability to bypass authentication...

Hardcoded credentials

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...

CVE-2018-10813

Dedos-web 1.0 has hardcoded session cookies/secrets in the Express.js app, exposed in GitHub source. An attacker can modify session cookie contents and re-sign them with the hardcoded secret via Passport.js, enabling privilege escalation. Public references (CNVD/NVD) confirm hardcoded credentials...