ZenML Security Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A security vulnerability exists in ZenML version 0.55.3, which stems from an improper authorization vulnerability in the API PUT /api/v1/users/id endpoint that allows an attacker...

PT-2024-18648 · Zenml Io · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml versions up to and including 0.55.3 Description: A race condition issue exists, allowing for the creation of multiple users with the same username when requests are sent in parallel. This is due to insufficient handling of...

PT-2024-26510 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A SQL injection issue allows attackers to execute arbitrary SQL commands via the password parameter in the /hrm/user/ API endpoint. Recommendations: For SourceCodester...

PT-2024-22391 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 1.0 Description: The issue allows attackers to manipulate user parameters for unauthorized access and modifications via a crafted POST request to "/patient/edit-user.php". This is related to an Insecure Dire...

CVE-2024-24050

Cross Site Scripting XSS vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firstname and lastname in /add-user.php...

PT-2024-20255 · Sourcecodester · Sourcecodester Workout Journal App

Name of the Vulnerable Software and Affected Versions: Sourcecodester Workout Journal App version 1.0 Description: The issue allows attackers to run arbitrary code via parameters firstname and lastname in the "/add-user.php" API endpoint. This enables attackers to execute arbitrary code,...

Log Injection

ckan is vulnerable Log Injection. The vulnerability is due to the lack of filtering on incoming parameters in the user endpoint, allowing attackers to inject false log entries or corrupt the log file format, resulting in Log Injection...

Format string

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade...

CVE-2024-27097 Potential log injection in reset user endpoint in ckan

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade...

CVE-2024-27097 Potential log injection in reset user endpoint in ckan

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade...

CVE-2023-49548

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customersupport/ajax.php?action=saveuser...

PT-2024-21045 · Pimcore · Pimcore Admin Classic Bundle

Name of the Vulnerable Software and Affected Versions: pimcore/admin-ui-classic-bundle versions prior to 1.3.4 Description: A potential security issue has been discovered in the pimcore/admin-ui-classic-bundle. The issue involves a Host Header Injection in the invitationLinkAction function of the...

Grafana Security Vulnerabilities

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability that stems from a security flaw in the PUT /api/user handler...

CVE-2024-24060

springboot-manager v1.6 is vulnerable to Cross Site Scripting XSS via /sys/user...

PT-2024-20259 · Unknown · Springboot-Manager

Name of the Vulnerable Software and Affected Versions: springboot-manager version 1.6 Description: The issue is related to Cross Site Scripting XSS via the "/sys/user" API endpoint. This allows for potential malicious script execution. The estimated number of potentially affected devices worldwid...

PT-2024-15237 · Unknown · Meetyoucrop Big-Whale

Name of the Vulnerable Software and Affected Versions: meetyoucrop big-whale version 1.1 Description: A critical issue affects some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the id argument leads to improper ownership management. The...

CVE-2023-6463

A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument firstname leads to cross site scripting. The attac...

SourceCodester User Registration and Login System Cross-Site Scripting Vulnerability

User Registration and Login System is a user registration and login system by Remy Andrade, an individual developer. A cross-site scripting vulnerability exists in the SourceCodester User Registration and Login System, which is caused by cross-site scripting in the user parameter of...

PT-2023-32675 · Sourcecodester · Sourcecodester User Registration/Login System

Name of the Vulnerable Software and Affected Versions: SourceCodester User Registration and Login System version 1.0 Description: A problematic issue was found in the system, affecting an unknown function of the file /endpoint/delete-user.php. The manipulation of the user argument leads to...

PT-2023-32676 · Unknown · Sourcecodester User Registration/Login System

Name of the Vulnerable Software and Affected Versions: SourceCodester User Registration and Login System version 1.0 Description: A vulnerability has been found in the system, classified as problematic. It affects an unknown functionality of the file "/endpoint/add-user.php". The manipulation of...