An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.

...

PT-2022-23239 · Unknown · Orange Station

Name of the Vulnerable Software and Affected Versions: Orange Station version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the username parameter. Recommendations: For Orange Station version 1.0, update to a version that includes ...

Orange Station SQL Injection Vulnerability

Orange Station is a garage management system by Mayuri K. Personal developer. It helps users to manage all vehicles, cars and motorcycles. Orange Station version 1.0 suffers from a SQL injection vulnerability that stems from a security issue with the username parameter, which can be exploited by ...

Garage Management System 1.0 Shell Upload Exploit

Exploit Title: Garage Management System Remote Code Execution via File Upload Exploit Author: saitamang Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/mayurik/garage.zip Version: 1.0 Tested on: Centos 7 + MySQL import...

CVE-2022-36161: Improper Neutralization of Special Elements used in an SQL Command

Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

Sql injection

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

PT-2022-19792

Name of the Vulnerable Software and Affected Versions CLink Office version 2.0 Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities can be exploited via the username and password parameters. Recommendations For version 2.0, consider restricting access to th...

CVE-2022-29709: Improper Neutralization of Special Elements used in an SQL Command

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

Communilink CLink Office SQL Injection Vulnerability

Communilink CLink Office is a control panel for unified management of email and anti-spam filters from Communilink, Hong Kong, China. A security vulnerability exists in CommuniLink CLink Office version v2.0. The vulnerability is exploited by attackers to conduct SQL injection attacks via the...

Send message in chat function with any username

Description In chat function, username is not validated. We can change username to any value we want which not match with logged in user. Exploitation steps: 1. Login with Phil1 account Patient account. 2. Send message via Burpsuite proxy 3. Modify username to any value you want I user "n00b" 4. ...

CVE-2022-34046

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

CVE-2022-34047

An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd...

CVE-2022-34046

The CVE-2022-34046 issue affects WAVLINK WN533A8 (M33A8.V5030.190716). It is an improper access control vulnerability enabling an attacker to retrieve usernames and passwords by inspecting view-source:http:///sysinit.shtml?r=52300 and spotting logincheck(user);. Impact could include unauthorized ...

CVE-2022-34046

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

Apache Tomcat Realm Information Disclosure

The vulnerability of the Apache Tomcat application server’s Realm implementation is related to the exposure of information through mismatches. Exploiting this vulnerability allows a remote attacker to discover all existing user names...

CVE-2022-34046: Incorrect Authorization

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...