CVE-2021-3632

CVE-2021-3632 is a Keycloak/WebAuthn flow flaw that allows an attacker to register a new security device or key for any user when no device exists for that user. The issue is present in Red Hat SSO 7.x as part of the 7.4.9 security updates; Red Hat advisories RHSA-2021:3527/3528/3529 list the fix...

CVE-2021-3632

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow...

EUVD-2024-1917

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password...

Red Hat Keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak suffers from a security vulnerability that originates from an attacker being able to register with a username that is the same...

Linksys MR8300 OS Command Injection Vulnerability

Linksys MR8300 is a high-performance tri-band router from Linksys, Inc. The Linksys MR8300 Router version 1.0 contains an operating system command injection vulnerability, which stems from the fact that by specifying a username and password when registering for DDNS services, an attacker could us...

The vulnerability of the Azure Arc Jumpstart application, related to the disclosure of information through registration files, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Azure Arc Jumpstart application relates to the disclosure of information through registration files. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2022-24226 · Linksys · Linksys Mr8300 Router

Name of the Vulnerable Software and Affected Versions: Linksys MR8300 Router version 1.0 Description: A command injection issue exists in the Linksys MR8300 router during the registration process for the DDNS Service. An attacker connected to the router's web interface can execute arbitrary OS...

CVE-2020-23466

Cross Site Scripting XSS vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field...

CVE-2020-23466

Cross Site Scripting XSS vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field...

CVE-2020-23466

CVE-2020-23466 concerns a Cross Site Scripting (XSS) vulnerability in the phpgurukul Online Marriage Registration System version 1.0, exploitable via the wzipcode field. The PT-2022-8660 entry documents the affected software/version and notes that unsanitized input in the wzipcode field enables a...

CVE-2020-23466

Cross Site Scripting XSS vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field...

Online Marriage Registration System 跨站脚本漏洞

Online Marriage Registration System is a website builder that supports online marriage registration. A cross-site scripting vulnerability exists in Online Marriage Registration System version 1.0. An attacker can exploit this vulnerability to execute arbitrary code via the wzipcode field...

PT-2022-8660 · Unknown · Phpgurukul Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: phpgurukul Online Marriage Registration System version 1.0 Description: A Cross Site Scripting XSS issue exists, allowing attackers to run arbitrary code via the wzipcode field. This enables attackers to execute malicious scripts on the syste...

Nearly 2,000 Signal users affected by Twilio phishing attack

New findings following the Twilio phishing attack revealed that Signal, one of its high-value clients and a popular encrypted messaging platform, was particularly affected. 1,900 of its users had their phone numbers and SMS registration codes exposed. However, Signal reassured users that the...

The vulnerability of the monitoring tool for VMware vRealize Operations, related to insufficient protection of registration data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the monitoring tool for VMware vRealize Operations is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of VMware Workstation’s hypervisor is related to insufficient protection of registration data, allowing attackers to disclose protected information.

The vulnerability of VMware Workstation hypervisor is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

Nearly 1,900 Signal Messenger Accounts Potentially Compromised in Twilio Hack

Popular end-to-end encrypted messaging service Signal on Monday disclosed the cyberattack aimed at Twilio earlier this month may have exposed the phone numbers of roughly 1,900 users. "For about 1,900 users, an attacker could have attempted to re-register their number to another device or learned...

The vulnerability of the PLC programming software EcoStruxure Control Expert, the automation system ProcessExpert, and the configuration software SCADAPack RemoteConnect lies in the insufficient protection of registration data, allowing unauthorized access by attackers to the device.

The vulnerabilities of the PLC programming software EcoStruxure Control Expert, the automation system ProcessExpert, and the configuration software SCADAPack RemoteConnect are related to insufficient protection for registration data. Exploiting these vulnerabilities can allow attackers to gain...

Affiliates Manager < 2.9.14 - Affiliate CSV Injection

The plugin does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data Register as an affiliate and put the following payload in the Firstname, Lastname or Company fields: =10+2+30 As admi...