Khan Academy: Creating Unlimited Fake Accounts.

Hello @khanacademy, Anyone can create unlimited fake accounts using temp mails. i,e https://temp-mail.org/en/ 1- Go to https://temp-mail.org/en/ 2- Select an mail 3- Enter that mail while creating an account in khanacademy 4- You will get confirm mail from khanacademy on https://temp-mail.org/en/...

CVE-2018-16793

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA Outlook Web Access login page...

Cisco Issues New Warning for 6-Month-Old Critical Bug in IOS XE

UPDATE Cisco Systems has issued a second warning for a critical static credential bug in its IOS XE software, which allows an unauthenticated attacker to gain access to targeted systems. The security bulletin comes more than six months after the company initially reported the bug and provided a...

Mgetty Buffer Overflow Vulnerability (CNVD-2019-03437)

Mgetty is a getty replacement program for data and fax operations. A stack buffer overflow vulnerability exists in the contrib/next-login/login.c file in versions of Mgetty prior to 1.2.1, which stems from a program passing an unfiltered 'username' parameter to the 'strcpy ' function, which can b...

D-Link DIR-600M Cross-Site Scripting Vulnerability

D-Link DIR-600M is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the DNS Configuration page in the D-Link DIR-600M, which can be exploited by remote attackers to inject arbitrary web script or HTML with the Hostname and Username fields...

UBUNTU-CVE-2018-16743

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

DEBIAN-CVE-2018-16743

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

PT-2018-13717 · Mgetty +2 · Mgetty +2

Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: An issue was discovered in the contrib/next-login/login.c file, where the command-line parameter username is passed unsanitized to the strcpy function, which can cause a stack-based buffer overflow...

Design/Logic Flaw

D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page...

CVE-2017-17691

Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which allows remote attackers to obtain sensitive information via a man in the middle attack...

CVE-2018-16604

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

Bludit cross-site scripting vulnerability (CNVD-2018-19087)

Bludit is an open source and free lightweight blogging CMS content management system system. A cross-site scripting vulnerability exists in Bludit version 2.3.4, which can be exploited by remote attackers to execute JavaScript code with the help of a user name...

FreeBSD : grafana -- LDAP and OAuth login vulnerability (1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea)

Grafana Labs reports : On the 20th of August at 1800 CEST we were contacted about a potential security issue with the 'remember me' cookie Grafana sets upon login. The issue targeted users without a local Grafana password LDAP & OAuth users and enabled a potential attacker to generate a valid...

ThinkPHP SQL Injection Vulnerability (CNVD-2019-17159)

ThinkPHP is an open source, lightweight PHP-based web application development framework. A SQL injection vulnerability exists in ThinkPHP versions prior to 5.1.23. The vulnerability stems from the program not correctly filtering the key value of an array, which can be exploited by a remote attack...

CVE-2018-16324

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field...

Design/Logic Flaw

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field...

CVE-2018-16324

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field...

Network Manager VPNC Username Privilege Escalation

This Metasploit module exploits an injection vulnerability in the Network Manager VPNC plugin to gain root privileges. This Metasploit module uses a new line injection vulnerability in the configured username for a VPN network connection to inject a Password helper configuration directive into th...

Network Manager VPNC Username Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Network Manager VPNC Username Privilege Escalation', 'Description' = %q This module exploits an injection vulnerability in the Network Manager VP...

NetworkActiv Web Server 4.0 Pre-Alpha-3.7.2 Denial Of Service

Exploit Title: NetworkActiv Web Server 4.0 Pre-Alpha-3.7.2 - 'Username' Denial of Service PoC Discovery by: Victor MondragA3n Discovery Date: 2018-08-30 Vendor Homepage: https://www.networkactiv.com/WebServer.html Software Link: https://www.networkactiv.com/Dev/ Tested Version: 4.0 Pre-Alpha-3.7....