4913 matches found
CVE-2023-41615
CVE-2023-41615 affects Zoo Management System v1.0, with multiple SQL injection vulnerabilities in the Admin sign‑in page via the username and password fields. The root cause is insufficient input validation on the sign‑in form, enabling arbitrary SQL execution and potential data theft. While seve...
CVE-2023-41575: Improper Neutralization of Input During Web Page Generation
Multiple stored cross-site scripting XSS vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters...
CVE-2023-41161
Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...
PT-2023-28000 · Unknown · Zoo Management System
Name of the Vulnerable Software and Affected Versions: Zoo Management System version 1.0 Description: The issue is related to multiple SQL injection vulnerabilities found in the Admin sign-in page of the Zoo Management System. These vulnerabilities can be exploited via the username and password...
CVE-2023-41161
Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...
CVE-2023-41161
Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...
CVE-2023-41161
Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...
CVE-2023-20238
A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...
CVE-2023-20238
A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...
PT-2023-4831 · Cisco · Cisco Broadworks Application Delivery Platform +1
Name of the Vulnerable Software and Affected Versions: Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform affected versions not specified Description: A vulnerability in the single sign-on SSO implementation of the affected platforms could allow an...
Cisco BroadWorks Application Security Vulnerability
Cisco BroadWorks Application is an enterprise-grade calling and collaboration platform from Cisco USA. A security vulnerability exists in the Cisco BroadWorks Application Delivery Platform and Xtended Services Platform that stems from an improper method used to authenticate SSO tokens, allowing a...
decentraland-gatsby (>=5.76.0, <=5.77.1) potentially affected by CVE-2023-41049 via @dcl/single-sign-on-client (0.0.13)
@dcl/single-sign-on-client NPM version 0.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on @dcl/single-sign-on-client and may be impacted: - decentraland-gatsby =5.76.0, =5.77.1 Source cves: CVE-2023-41049 Source advisory: OSV:GHSA-VP4F-WXGW-7X8X...
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Impact Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix ts SSO.init'javascript:alert"javascript successfully injected"' Patches This vulnerability was patched on version 0.1.0 Workarounds This vulnerability can be prevented if...
GHSA-VP4F-WXGW-7X8X Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Impact Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix ts SSO.init'javascript:alert"javascript successfully injected"' Patches This vulnerability was patched on version 0.1.0 Workarounds This vulnerability can be prevented if...
CVE-2023-41049
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are...
Input validation
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are...
CVE-2023-41049 Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are...
CVE-2023-41049 Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are...
CVE-2023-41049
The CVE-2023-41049 entry concerns @dcl/single-sign-on-client (an open-source npm library for SSO). The documented flaw is improper input validation in the init function, which can allow arbitrary JavaScript to be executed when a javascript: prefix is supplied. A patch exists in version 0.1.0, and...