448 matches found
GHSA-RQ95-XF66-J689
creationtimestamp| type| source ---|---|--- 2024-02-01 00:36:13+00:00| seen| https://t.me/ctinow/177221...
RHSA-2024:0489
creationtimestamp| type| source ---|---|--- 2024-01-31 18:16:40+00:00| seen| https://t.me/ctinow/176942...
CVE-2024-0988
A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument AppUserid/AppuserToken leads to improper authentication. The explo...
CVE-2023-28900 Nickname Disclosure on the Backend Automotive Server
The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number...
Omniauth::MicrosoftGraph Account takeover (nOAuth)
Summary The implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the email is used as a trusted user identifier...
CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)
omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...
CVE-2023-41998
creationtimestamp| type| source ---|---|--- 2023-12-17 09:37:23+00:00| seen| https://t.me/ctinow/155552...
GHSA-MWWQ-V92J-38XR
creationtimestamp| type| source ---|---|--- 2023-11-29 16:58:47+00:00| seen| https://t.me/arpsyndicate/773...
Loan Management System SQL Injection Vulnerability
Loan Management System is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System version 1.0, which stems from an incorrect manipulation of the parameter userid that can lead to sql injection...
Symfony possible session fixation vulnerability
Description SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token...
DEBIAN-CVE-2023-46733
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, SessionStrategyListener does not migrate the session after every successful login. It does so only in case the logged in...
Symfony Security Vulnerabilities
Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony, Inc. A security vulnerability exists in Symfony that stems from a user identifier not changing between the authentication phase and a successful login...
Best Courier Management System Security Vulnerability
Best Courier Management System is a courier management system by Mayuri K. Individual developer. A security vulnerability exists in Best Courier Management System version v.1.0 that could allow a remote attacker to execute arbitrary code and prompt for privileges via the userID parameter using a...
PT-2023-30281 · Unknown · Best Courier Management System
Name of the Vulnerable Software and Affected Versions: Best Courier Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. Recommendations: For Best Courier Management System...
CVE-2023-46930
creationtimestamp| type| source ---|---|--- 2023-11-01 17:21:47+00:00| seen| https://t.me/cibsecurity/73330...
sudo-rs: Path Traversal vulnerability
Impact An issue was discovered where usernames containing the . and / characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For exampl...
TTSPlanning SQL Injection Vulnerability
TTSPlanning is a solar power monitoring application from TTSPlanning Japan. TTSPlanning suffers from a SQL injection vulnerability that stems from the fact that manipulation of the parameter uid can lead to sql injection...
CVE-2023-24548
creationtimestamp| type| source ---|---|--- 2023-08-29 20:17:40+00:00| seen| https://t.me/cibsecurity/69364...
CVE-2023-4436
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/editupdate.php. The manipulation of the argument userid leads to sql injection. The attack may be initiated...