Cross site scripting

A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups section of the network tab, it is stored as the group name. Whenever another member visits that group, this payload executes...

Micro Focus Operations Bridge Reporter userName Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Micro Focus Operations Bridge Reporter. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the userName parameter provided to the...

HCL OneTest License Issue Vulnerability

HCL OneTest is a software testing tool from HCL India that provides multiple testing options. The software supports API testing, functional testing, UI testing, performance testing and service virtualization to support software automation testing. An authorization issue vulnerability exists in HC...

Cross site scripting

Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting XSS. When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link...

How to Audit Password Changes in Active Directory

Today's admins certainly have plenty on their plates, and boosting ecosystem security remains a top priority. On-premises, and especially remote, accounts are gateways for accessing critical information. Password management makes this possible. After all, authentication should ensure that a user ...

CVE-2021-25759

CVE-2021-25759 affects JetBrains Hub prior to 2020.1.12629, where an authenticated user can delete 2FA settings of any other user. This is documented across multiple sources (NVD/Red Hat/CNVD mirrors and the JetBrains Security Bulletin Q4 2020). The JetBrains bulletin states the issue was resolve...

Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection

The plugin did not sanitise the mecpostid POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue. If the Frontend Event Submission form is embed in a public page, then it could lead to any authenticated user, like subscribers to...

CVE-2020-23355

PRODUCT NOT SUPPORTED WHEN ASSIGNED Codiad 2.8.4 /componetns/user/class.user.php:Authenticate is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully...

Cemetery Mapping And Information System 1.0 SQL Injection

Exploit Title: Cemetry Mapping and Information System 1.0 - 'useremail' Sql Injection Authentication Bypass Exploit Author: Marco Catalano Date: 2021-01-25 Vendor Homepage: https://www.sourcecodester.com/php/12779/cemetery-mapping-and-information-system-using-phpmysqli.html Software Link:...

CVE-2020-27266

CVE-2020-27266 affects Dana Diabecare RS, AnyDana-i and AnyDana-A insulin pumps and companion mobile apps. Description and connected advisories confirm a client-side control vulnerability that enables physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy, po...

CVE-2020-27266

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy...

Azure AD. Attack of the Default Config

Uncloaking dangerous and default configurations within Azure. TL; DR There are several default configurations within the admin portal of Azure. The main affected area is Azure Active Directory Azure AD which is the primary area that controls user authentication, group memberships and privileges...

Baby Care System 1.0 - 'Post title' Stored XSS

Exploit Title: Baby Care System 1.0 - 'Post title' Stored XSS Exploit Author: Hardik Solanki Vendor Homepage: https://www.sourcecodester.com/php/14622/baby-care-system-phpmysqli-full-source-code.html Software Link:...

CVE-2020-28073

SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system...

Sql injection

SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system...

CVE-2020-28073

SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system...

CVE-2020-28073

CVE-2020-28073 affects SourceCodester Library Management System 1.0. The vulnerability is a SQL injection in the login/authentication flow that allows an attacker to bypass authentication and impersonate any user. The attack is demonstrated in public references (e.g., PacketStorm) with a repro sh...

Dolibarr 12.0.3 SQL Injection / Remote Code Execution

Exploit Title: Dolibarr 12.0.3, SQLi to RCE Date: 2/12/2020 Exploit Author: coiffeur Write Up: https://therealcoiffeur.github.io/c10010, https://therealcoiffeur.github.io/c10011 Vendor Homepage: https://www.dolibarr.org/ Software Link: https://www.dolibarr.org/downloads.php,...

CVE-2020-26834

CVE-2020-26834 concerns SAP HANA Database 2.0 where SAML bearer token-based user authentication does not properly validate usernames. The vulnerability allows a valid SAML bearer token to authenticate as a user whose name equals the truncated username for whom the token was issued. References des...

Cross-site Request Forgery (CSRF)

Mailman is vulnerable to Cross Site Request Forgery CSRF, Allows an attacker to remotely hijack the authentication of arbitrary users for requests by modify an option to gain access to the credentials of a victim's account...