CVE-2018-16432

BlueCMS 1.6 is affected by CVE-2018-16432 via SQL injection in the user_name parameter to uploads/user.php?act=index_login. The underlying issue is improper input handling that enables an attacker to inject SQL through that parameter. The CVSS metrics indicate a high to critical impact (CVSSv2: 7...

FreeBSD : slurm -- insecure handling of user_name and gid fields (3a66cb69-716f-11e8-be54-3085a9a47796)

SchedMD reports : Insecure handling of username and gid fields CVE-2018-10995 While fixes are only available for the supported 17.02 and 17.11 releases, it is believed that similar vulnerabilities do affect past versions as well. The only resolution is to upgrade Slurm to a fixed release. C Tenab...

SchedMD Slurm has an unspecified vulnerability

SchedMD Slurm is SchedMD's open source and highly scalable cluster management and job scheduling system for large and small Linux clusters. A security vulnerability exists in SchedMD Slurm versions prior to 17.02.11 and 17.1x.x prior to 17.11.7, which stems from the program's failure to properly...

slurm -- insecure handling of user_name and gid fields

SchedMD reports: Insecure handling of username and gid fields CVE-2018-10995 While fixes are only available for the supported 17.02 and 17.11 releases, it is believed that similar vulnerabilities do affect past versions as well. The only resolution is to upgrade Slurm to a fixed release...

QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the USERNAME parameter provided to the changepassword.cgi endpoint. The issue...

Sql injection

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...

CVE-2017-14402

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

Sql injection

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

CVE-2017-14401

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...

CVE-2017-14402

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

CVE-2017-14401

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...

CVE-2017-14401

The EyesOfNetwork web interface (eonweb) 5.1-0 contains a SQL injection vulnerability in the USERNAME column, exploitable via the user_name parameter to module/admin_user/add_modify_user.php within the ACCOUNT UPDATE section. This allows an attacker to construct arbitrary SQL commands, enabling d...

CVE-2017-14402

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

CVE-2015-2843

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 userpass parameter in gologin.php or the PATHINFO to 3 gologin/validatecredentials/admin/ or 4 index.php/gosite/gogetuserinfo/...

Sql injection

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 userpass parameter in gologin.php or the PATHINFO to 3 gologin/validatecredentials/admin/ or 4 index.php/gosite/gogetuserinfo/...

PHP-Fusion MG User-Fotoalbum SQL Injection Vulnerability

No description provided by source. ----------------------------Information------------------------------------------------ +Name : PHP-Fusion mg user fotoalbum 1.0.1 = SQL injection Vulnerability Proof of Concept +Autor : Easy Laster +Date : 10.10.2010 +Script : PHP-Fusion mg user fotoalbum 1.0.1...

CVE-2013-3933

Cross-site scripting XSS vulnerability in the JoomShopping comjoomshopping component before 4.3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the username parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the JoomShopping comjoomshopping component before 4.3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the username parameter to index.php...

CVE-2013-3933

Cross-site scripting XSS vulnerability in the JoomShopping comjoomshopping component before 4.3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the username parameter to index.php...

CVE-2012-3805

Multiple cross-site scripting XSS vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 absendername, 2 absenderemail, or 3 absendernachricht parameter to the content page; 4...