438 matches found
CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
DEBIAN-CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
UBUNTU-CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
CVE-2019-12520: Improper Input Validation
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
Internet Bug Bounty: Cache Manager ACL Bypass
Summary: ACL Manager can be bypassed giving non authorized users to squid-internal-mgr. Possible to bypass other urlregex, but only focused on manager. with the hostname of the server running squid echo -e "GET https://jeriko.one%252f@:3128/squid-internal-mgr/activerequests HTTP/1.1\r\n\r\n" |nc...
CVE-2020-8510
An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...
Default credentials
An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...
CVE-2020-8510: Improper Authentication
An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...
PT-2020-20187
Name of the Vulnerable Software and Affected Versions phpABook version 0.9 Intermediate Description An issue allows login as any user without a password by setting a specific userInfo cookie value on the login page. The value admin+1+en representing user+perms+lang can be used to exploit this...
Stripo Inc: my.stripo.emai email verification bypassed and also create email templates
Summary: According to the Stripo.emai When the new user sign up Stripo.email allow to create email templates after the verification of the email of Your stripo account. Until your email get verified You are not able to create a email templates in your acc. User need to verified their email...
CVE-2019-18882
WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled...
python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies,...
CVE-2019-11078
MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI...
HBGK DVR 3.0.0 Build 20161206 Authentication Bypass
Exploit Title: HBGK DVR V3.0.0 build20161206 - Authentication Bypass Date: 24-09-2017 Vendor Homepage: http://www.hbgk.net/en/ Exploit Author: RAT - ThiefKing Contact: https://www.facebook.com/cctvsuperpassword Website: http://tromcap.com Category: webapps Tested on: V2.3.1 build20160927, V3.0.0...
Parameters in userinfo.php in Shield Spirit public number promotion system v1.3 have sql injection vulnerabilities
Shield Spirit public number promotion system is mainly applied to public number promotion alliance, suitable for personal and business subscription number and service number or enterprise number. Shield Spirit public promotion system v1.3 userinfo.php parameters in the existence of sql injection...
PT-2016-6309
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 54.0.2840.59 for Windows, Mac, and Linux Google Chrome version 54.0.2840.85 for Android Opera affected versions not specified Description The issue is related to insufficient validation of supplied data in...
jcms /interface/user/out_userinfo.jsp 文件 xmlinfo 参数敏感信息泄漏漏洞
No description provided by source...
UBUNTU-CVE-2015-1126
WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors...