527 matches found
MAL-2024-2998 Malicious code in self-service-flex (npm)
--- -= Per source details. Do not edit below this line.=-...
MTN Group: FULL ACCOUNT TAKEOVER
The selfservice portal at https://mymtn.com.ng/ allowed an attacker to take over any Nigerian MTN phone number. The attacker was able to access the account holder's personal information, such as date of birth and full name. The attacker also had the ability to use any available airtime on the...
Observable Timing Discrepancy
Overview Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the handling of RSA premaster secrets when an invalid secret is received. An attacker can potentially observe timing differences by exploiting the additional processing performed when the premaster...
SQL Injection Vulnerability in Campus Network Self-service System of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-28356)
Beijing StarNet Ruijie Network Technology Co., Ltd. is a leading ICT infrastructure and industry solutions provider. A SQL injection vulnerability exists in the campus network self-service system of Beijing StarNet Ruijie Network Technology Co., Ltd, which can be exploited by attackers to obtain...
ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command
ID: NFLX-2024-002 Impact Authenticated users can achieve limited RCE in ConsoleMe, restricted to flag inputs on a single CLI command. Due to this constraint, it is not currently known whether full RCE is possible but it is unlikely. However, a specific flag allows authenticated users to read any...
GHSA-3783-62VC-JR7X ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command
ID: NFLX-2024-002 Impact Authenticated users can achieve limited RCE in ConsoleMe, restricted to flag inputs on a single CLI command. Due to this constraint, it is not currently known whether full RCE is possible but it is unlikely. However, a specific flag allows authenticated users to read any...
KioWare 安全漏洞
KioWare is a suite of self-service terminal browser software. The software has the ability to restrict end-user access to specific interfaces. A security vulnerability exists in KioWare versions 8.34 and earlier, which originates from the ability to exit the software and use other open applicatio...
KioWare 安全漏洞
KioWare is a suite of self-service terminal browser software. The software has the ability to restrict end-user access to specific interfaces. A security vulnerability exists in KioWare version 8.34 and prior versions, which stems from a vulnerability that allows brute force decryption of a PIN...
CVE-2023-45552
In VeridiumID before 3.5.0, a stored cross-site scripting XSS vulnerability has been discovered in the admin portal that allows an authenticated attacker to take over all accounts by sending malicious input via the self-service portal...
CVE-2023-45552
In VeridiumID before 3.5.0, a stored cross-site scripting XSS vulnerability has been discovered in the admin portal that allows an authenticated attacker to take over all accounts by sending malicious input via the self-service portal...
PT-2024-13251 · Veridium · Veridiumid
Name of the Vulnerable Software and Affected Versions: VeridiumID versions prior to 3.5.0 Description: A stored cross-site scripting issue has been found in the admin portal of the affected software. This allows an authenticated attacker to potentially take over all accounts by sending malicious...
CVE-2023-45552
VeridiumID prior to 3.5.0 contains a stored XSS vulnerability in the admin portal that allows an authenticated attacker to take over all accounts by injecting malicious input through the self-service portal. Affected component: VeridiumID admin portal; vulnerability type: stored XSS; impact: acco...
CVE-2023-45552
In VeridiumID before 3.5.0, a stored cross-site scripting XSS vulnerability has been discovered in the admin portal that allows an authenticated attacker to take over all accounts by sending malicious input via the self-service portal...
CVE-2023-45552
In VeridiumID before 3.5.0, a stored cross-site scripting XSS vulnerability has been discovered in the admin portal that allows an authenticated attacker to take over all accounts by sending malicious input via the self-service portal...
VeridiumID 安全漏洞
VeridiumID is an integrated passwordless platform from VeridiumID. A security vulnerability exists in VeridiumID versions prior to 3.5.0. An attacker exploited the vulnerability to take over all accounts by sending malicious input through the self-service portal...
CVE-2023-49339
Ellucian Banner 9.17 allows Insecure Direct Object Reference IDOR via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint...
Design/Logic Flaw
Ellucian Banner 9.17 allows Insecure Direct Object Reference IDOR via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint...
Ellucian Security Breach
Ellucian is Ellucian's open and flexible technology ecosystem supporting SaaS. A security vulnerability exists in Ellucian Banner version 9.17 and earlier, which stems from an insecure direct object reference IDOR vulnerability in the endpoint /StudentSelfService/ssb/studentCard/retrieveData...
NCR Atleos Terminal Handler Cross-Site Request Forgery Vulnerability
NCR Atleos Terminal Handler is an ATM enterprise software solution from NCR Atleos that reduces costs, improves business agility and increases your competitive advantage. A cross-site request forgery vulnerability exists in NCR Atleos Terminal Handler version v.1.5.1, which originates from a...