GHSA-PX3R-27QC-HX5G NT auth module vulnerability in OpenAM

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...

NT auth module vulnerability in OpenAM

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...

Observable timing discrepancy allows determining username validity in Jenkins

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This...

GHSA-9GRJ-J43M-MJQR Observable timing discrepancy allows determining username validity in Jenkins

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This...

MELAG FTP Server security vulnerability

MELAG FTP Server is an FTP server from the German company MELAG. version 2.2.0.4 of MELAG FTP Server is vulnerable to a user enumeration vulnerability, which stems from the fact that the program presents different responses to users and non-users, and can be exploited by attackers to identify...

PT-2022-18320

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.4.7 and earlier Description The issue concerns stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject a JavaScript payload in their username. The payload gets executed in the...

CVE-2021-41638: Improper Authentication

The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username...

CVE-2022-27238: Improper Neutralization of Input During Web Page Generation

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-32987

Multiple cross-site scripting XSS vulnerabilities in /bsms/?page=manageaccount of Simple Bakery Shop Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username or Full Name fields...

CVE-2022-32987

Multiple cross-site scripting XSS vulnerabilities in /bsms/?page=manageaccount of Simple Bakery Shop Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username or Full Name fields...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in /bsms/?page=manageaccount of Simple Bakery Shop Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username or Full Name fields...

CVE-2022-34298

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...

CVE-2022-34298

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...

CVE-2022-34174

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm...

Code injection

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...

Default credentials

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm...

OpenAM security vulnerabilities

OpenAM Open Source Edition is an open source single sign-on framework. The product achieves transparent single sign-on e.g., centralized, distributed single sign-on in a network architecture by providing a core identity service Core Server. A security vulnerability exists in OpenAM that stems fro...

Simple Bakery Shop Management Cross-site Scripting Vulnerability

Simple Bakery Shop Management is a bakery store management system. A security vulnerability exists in Simple Bakery Shop Management System v1.0, which originates from multiple cross-site scripting XSS vulnerabilities in /bsms/?page=manageaccount. An attacker can exploit this vulnerability to...

CVE-2022-32987: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in /bsms/?page=manageaccount of Simple Bakery Shop Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username or Full Name fields...

PT-2022-21622

Name of the Vulnerable Software and Affected Versions Simple Bakery Shop Management System version 1.0 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username or Full Name fields in the /bsms/?page=manage account API endpoin...