12044 matches found
Citrix Provisioning Services - PVS Server 2303 Fails To Register With Citrix Cloud
While running the configuration wizard to register your PVS Server against Citrix Cloud you are greeted by an unexpected console error. "Error Registering Server, Sequence contains no matching element" as shown below: The PVS configwizard.log file will show you this exception:...
VulnCheck KEV: CVE-2023-29552
The Service Location Protocol SLP contains a denial-of-service DoS vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service DoS attack with a significant amplification factor...
Design/Logic Flaw
A flaw was found in the Open Cluster Management OCM when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service...
Complaint Management System SQL Injection Vulnerability
Complaint Management System is a complaint management system. A SQL injection vulnerability exists in Complaint Management System version 1.0, which stems from a problem in the file users/registration.php, where manipulation of the parameter fullname can lead to sql injection. No details of the...
Yoga Class Registration System SQL Injection Vulnerability
Yoga Class Registration System is a yoga class registration system. A SQL injection vulnerability exists in Yoga Class Registration System v1.0, which originates from the lack of validation of the cid parameter in /admin/login.php against external SQL input. An attacker can exploit this...
PT-2023-2946 · Unknown · Expo Framework
Name of the Vulnerable Software and Affected Versions: Expo framework affected versions not specified Description: The issue is related to the implementation of the OAuth standard in the Expo framework, specifically with insufficient protection of registration data. An attacker can exploit this t...
UBUNTU-CVE-2023-29552
The Service Location Protocol SLP, RFC 2608 allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor...
CVE-2023-2243
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection...
PT-2023-18493 · Sourcecodester · Sourcecodester Complaint Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Complaint Management System version 1.0 Description: A critical issue was found in the SourceCodester Complaint Management System, affecting some unknown functionality of the file users/registration.php of the component POST...
Complaint Management System SQL注入漏洞
Complaint Management System is a complaint management system. A SQL injection vulnerability exists in Complaint Management System version 1.0, which stems from a problem in the file users/registration.php, where manipulation of the parameter fullname can lead to sql injection. No details of the...
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
Impact If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. To reproduce: On a wiki with view rights for guests but user registration disabled, open as guest...
GHSA-FP36-MJW5-FMGX xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
Impact If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. To reproduce: On a wiki with view rights for guests but user registration disabled, open as guest...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
Input validation
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...
CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...
Mars: ████ ' can change any account email and cannot retrieve his account and access it ' at ███
The security vulnerability described a method to change the email address of any user account, preventing the original user from accessing their account. The vulnerability involved manipulating the user profile update functionality to modify the email address. Despite an error message when...
Cross site request forgery (csrf)
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, suc...